Vendor Risk & IT GRC Analyst

Core Specialty Insurance Holdings, Inc.; Cincinnati (OH); Hybrid; USD 85,000 - 120,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Life insurance

Disability insurance

401(k) with company match

Employee Assistance Plan

Health Savings Account

Wellness program

Job summary

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC - Risk Analyst to help assess, monitor, and manage third-party technology and cybersecurity risks.

You will review vendor questionnaires, SOC reports, and certifications while supporting remediation tracking and ongoing monitoring activities. The role collaborates with IT, cybersecurity, procurement, legal, compliance, and business owners to strengthen the third-party risk management program and ensure alignment with internal policies

Qualifications

• 3+ years in IT GRC, IT Audit, or risk function.
• Experience with risk assessments, remediation tracking, and governance artifacts.
• Familiarity with NIST CSF, ISO 27001, COBIT, HIPAA, NYDFS or SOX.

Responsibilities

• Assist third-party risk management through assessments, evidence collection, and remediation tracking.
• Review vendor controls against internal requirements and regulatory expectations.
• Support risk rating activities and risk-based decisions.
• Maintain audit-ready assessment records and documentation.

Skills

GRC concepts

Vendor risk assessments

SOC 2

Risk rating

Documentation

Education

Bachelor’s degree in Information Systems / Cybersecurity

Tools

Jira

Confluence

SharePoint

Power BI

Microsoft 365

Job description

Core Specialty Insurance Holdings, Inc. is seeking an IT GRC - Risk Analyst to help assess, monitor, and manage third-party technology and cybersecurity risks.

You will review vendor questionnaires, SOC reports, and certifications while supporting remediation tracking and ongoing monitoring activities. The role collaborates with IT, cybersecurity, procurement, legal, compliance, and business owners to strengthen the third-party risk management program and ensure alignment with internal policies