Vulnerability Management & GRC Analyst

Selective Insurance; Hartford (CT); On-site; USD 116,000 - 157,000; Full time

Benefits offered by this job

Comprehensive health care plans

Retirement plan with company match

Tuition assistance

20 days paid time off

Job summary

Selective Insurance seeks a GRC Analyst to perform governance, risk, and compliance activities, coordinating vendor due diligence and vulnerability management efforts. The role supports audits, policy updates, and reporting to stakeholders with strong attention to evidence and control alignment.

The position emphasizes evaluating security evidence, communicating clearly with business stakeholders, and tracking remediation and risk items within a regulated environment.

Qualifications

• Working understanding of cybersecurity, risk management, compliance, vulnerability management, audit, or third-party risk concepts.

Responsibilities

• Execute GRC activities including risk documentation, control mapping, exception tracking, and assessment record maintenance.
• Coordinate vendor assessment intake, due diligence requests, follow-ups, and stakeholder communications.
• Review vendor questionnaires, SOC reports, ISO certifications, penetration test summaries, and other due diligence artifacts.
• Support vulnerability governance by tracking remediation status, exception requests, and aging issues.
• Collect, organize, and validate audit evidence per control objectives and regulatory expectations.

Skills

Cybersecurity basics

Risk management

Compliance concepts

Vulnerability management

Audit understanding

Third-party risk

Tools

GRC platforms

Microsoft Office

Job description

Selective Insurance seeks a GRC Analyst to perform governance, risk, and compliance activities, coordinating vendor due diligence and vulnerability management efforts. The role supports audits, policy updates, and reporting to stakeholders with strong attention to evidence and control alignment.

The position emphasizes evaluating security evidence, communicating clearly with business stakeholders, and tracking remediation and risk items within a regulated environment.