Strategic Vendor Risk & IT GRC Analyst

Core Specialty; Cincinnati (OH); Hybrid; USD 85,000 - 115,000; Full time

Benefits offered by this job

Medical insurance

Dental & Vision

401(k) match

Employee Assistance Plan

Wellness program

Job summary

Core Specialty in Cincinnati seeks an IT GRC Risk Analyst to support evaluating and monitoring technology and cybersecurity risks from third parties. You will review vendor questionnaires, SOC reports, and security documentation to identify control gaps and risk factors.

You will collaborate with IT, procurement, legal, compliance, and business owners to collect evidence, track remediation, and prepare risk summaries for leadership review.

Qualifications

• Bachelor’s degree or equivalent work experience in a related field.
• 3+ years of experience in IT GRC, risk management, compliance, or related technology risk function.
• Experience supporting technology and cybersecurity risk assessments and governance activities.
• Knowledge of IT risk management principles and control frameworks.

Responsibilities

• Conduct third-party risk assessments by reviewing vendor questionnaires and security documents.
• Identify and document third-party risks and remediation priorities.
• Track findings, remediation plans, and exceptions to completion.
• Prepare risk summaries, dashboards, and escalation materials for leadership.

Skills

GRC

Risk Assessments

Regulatory Frameworks

Vendor Risk

SOC 2

NIST CSF

ISO 27001

CISA/CRISC/CISM

Education

Bachelor's degree in Information Systems/Cybersecurity/Risk Management

Tools

Jira

Confluence

SharePoint

Power BI

Job description

Core Specialty in Cincinnati seeks an IT GRC Risk Analyst to support evaluating and monitoring technology and cybersecurity risks from third parties. You will review vendor questionnaires, SOC reports, and security documentation to identify control gaps and risk factors.

You will collaborate with IT, procurement, legal, compliance, and business owners to collect evidence, track remediation, and prepare risk summaries for leadership review.