Senior IT GRC Analyst: Risk & Compliance

WesBanco, Inc.; Wheeling (WV); On-site; USD 90,000 - 130,000; Full time

Job summary

WesBanco, Inc. in Wheeling, WV seeks an experienced IT GRC professional to support enterprise governance, risk and compliance programs, aligning technology risk posture with NIST CSF 2.0, FFIEC and CIS Controls.

You will manage risk assessments, control activities, third-party risk, and regulatory examinations, while developing KRIs and reporting metrics. Strong communication and industry certifications are preferred.

Qualifications

• Bachelor's degree in IS, Business, CS, or related field or equivalent.
• Minimum 4 years of relevant experience.
• Experience in a regulated financial institution preferred.
• CRISC, CISA, CISM, CGEIT, or CISSP preferred.
• Familiar with SOC 2, ITGC/SOX and cloud risk (AWS, Azure).
• Knowledge of GRC platforms and control/evidence workflows.

Responsibilities

• Maintain technology policy hierarchy aligned to NIST CSF 2.0, CIS Controls v8, and FFIEC guidance.
• Support IT risk assessment program and IT risk register with scoring & remediation workflows.
• Perform control self-assessments across IT domains (identity, change, vulnerability, data protection).
• Support Third-Party Risk Management including vendor due diligence and monitoring.
• Assist regulatory examinations (OCC, FDIC, Fed) and audits, tracking findings to closure.
• Develop and report technology risk metrics and KRIs for governance committees.
• Support AI governance activities (NIST AI RMF, ISO/IEC 42001) including inventory and lifecycle controls.

Skills

Communication skills

Analytical thinking

Problem solving

Education

Bachelor's degree in Information Systems, Business, Computer Science, or related field

Tools

ServiceNow GRC

Archer

Job description

WesBanco, Inc. in Wheeling, WV seeks an experienced IT GRC professional to support enterprise governance, risk and compliance programs, aligning technology risk posture with NIST CSF 2.0, FFIEC and CIS Controls.

You will manage risk assessments, control activities, third-party risk, and regulatory examinations, while developing KRIs and reporting metrics. Strong communication and industry certifications are preferred.