Senior IT GRC & Security Risk Lead

Marzetti Company; Columbus (OH); Hybrid; USD 90,000 - 130,000; Full time

Job summary

The Marzetti Company in Columbus, OH seeks a Senior IT GRC Analyst to connect governance, compliance, and security with business objectives. You will lead IT SOX, third-party risk, and control design across information systems and financial reporting.

You will partner with IT and Audit, develop risk metrics, support maturity assessments, and help build scalable, risk-based GRC and data security programs focused on protecting sensitive information and reducing exposure.

Qualifications

• Bachelor’s degree or equivalent work experience.
• 3-5 years’ experience in GRC, TPRM, SOX, Risk Management.
• SAP, Azure and ICS experience preferred.
• Professional certifications such as CISA, CRISC, CISSP, CISM, CGEIT, or CIA preferred.
• Experience in environments subject to SOX, audits and IT control requirements.

Responsibilities

• Assist IT SOX lifecycle activities including risk assessments, control scoping, testing readiness, evidence coordination, remediation tracking, and reporting.
• Develop risk assessment and reporting tools to prioritize initiatives based on business impact and risk appetite.
• Create metrics and reporting on control effectiveness, risk exposure, and third‑party risk.
• Support IT governance, policy development, and control design for new systems and changes.
• Execute Cyber Third‑Party Risk Management (TPRM) program and vendor risk assessments.
• Deploy data security monitoring capabilities to detect data exposure and access misuse.

Skills

GRC

SOX

TPRM

Risk Management

Education

Bachelor’s Degree in related field

Tools

SAP

Azure

ICS

Job description

The Marzetti Company in Columbus, OH seeks a Senior IT GRC Analyst to connect governance, compliance, and security with business objectives. You will lead IT SOX, third-party risk, and control design across information systems and financial reporting.

You will partner with IT and Audit, develop risk metrics, support maturity assessments, and help build scalable, risk-based GRC and data security programs focused on protecting sensitive information and reducing exposure.