Vendor Risk & IT GRC Analyst

Kalepa; Cincinnati (OH); Hybrid; USD 100,000 - 140,000; Full time

Benefits offered by this job

Health benefits

Job summary

Core Specialty is seeking an IT GRC - Risk Analyst in Cincinnati, OH to support third-party risk management, assess vendor risk, and coordinate remediation efforts. You will gather evidence, review SOC reports and certifications, and document risk findings across IT and business stakeholders.

The role emphasizes collaboration with IT, procurement, legal, compliance, and vendors to strengthen risk management and compliance readiness within regulatory frameworks.

Qualifications

• Bachelor’s degree in Information Systems, Cybersecurity, Risk Management, Information Assurance, Business Administration, or related field; or equivalent work experience.
• 3+ years of experience in IT Governance, Risk Management, Compliance (GRC), IT Audit, Cybersecurity, Internal Controls, or a related technology risk function.
• Experience supporting technology and cybersecurity risk assessments, risk analysis, control evaluations, compliance reviews, or governance activities.
• Experience using GRC, workflow, reporting, and collaboration tools such as Jira, Confluence, SharePoint, Microsoft 365, Power BI, or similar platforms.

Responsibilities

• Support the third-party risk management process as part of the IT GRC team, including initial assessments, reassessments, ongoing monitoring, and remediation tracking.
• Conduct third-party risk assessments by reviewing vendor questionnaires, security documentation, SOC reports, certifications, policies, penetration test summaries, and other evidence.
• Identify and document third-party technology, cybersecurity, privacy, operational, and compliance risks based on vendor responses and supporting documentation.
• Work with business owners, IT teams, cybersecurity, legal, procurement, compliance, and vendors to collect information and resolve assessment gaps.
• Review vendor control environments against internal requirements, regulatory expectations, and applicable frameworks.
• Prepare clear assessment summaries, risk reports, dashboards, status updates, and escalation materials for management review.

Skills

Analytical skills

Communication

Problem solving

Organizational skills

Education

Bachelor’s degree or equivalent

Tools

Jira

Confluence

SharePoint

Microsoft 365

Power BI

Job description

Core Specialty is seeking an IT GRC - Risk Analyst in Cincinnati, OH to support third-party risk management, assess vendor risk, and coordinate remediation efforts. You will gather evidence, review SOC reports and certifications, and document risk findings across IT and business stakeholders.

The role emphasizes collaboration with IT, procurement, legal, compliance, and vendors to strengthen risk management and compliance readiness within regulatory frameworks.