IT GRC Lead Analyst

IT GRC Lead Analyst reports to the AVP of IT Compliance and is responsible for leading governance, risk, and compliance activities across the IT organization. This role supports the design, execution, and ongoing maturity of the IT Governance, Risk, and Compliance (GRC) program by helping ensure IT policies, standards, controls, risks, and compliance activities align with regulatory requirements, audit expectations, enterprise risk objectives, and recognized frameworks such as SOX, NYDFS, COBIT, NIST, and ISO 27001.  

The IT GRC Lead Analyst serves as a key partner to IT leadership, control owners, cybersecurity, internal audit, external auditors, compliance, and enterprise risk teams. This role leads activities across IT governance, IT risk management, and IT compliance, including control monitoring, risk assessments, audit readiness, issue remediation, policy governance, framework alignment, reporting, and continuous improvement.
** Key Accountabilities/Deliverables:
*** Lead and directly execute day-to-day IT GRC activities across IT governance, IT risk, and IT compliance under the direction of the AVP of IT Compliance.
* Support the execution and maturity of the IT GRC program by both coordinating team activities and personally performing key deliverables, including risk assessments, control reviews, evidence validation, audit support, and remediation tracking.
* Lead and perform IT governance activities, including policy, standard, and procedure reviews; control ownership documentation; framework mapping; exception tracking; approval evidence; and governance reporting.
* Conduct IT risk assessments, including identifying risks, evaluating control design and operating effectiveness, documenting findings, assigning risk ratings, recommending remediation actions, and tracking issues through closure.
* Perform IT compliance monitoring activities, including control testing, evidence review, issue identification, remediation tracking, and validation of corrective actions.
* Coordinate and actively support audit readiness efforts by managing evidence requests, preparing control owners, reviewing documentation, tracking audit deliverables, and responding to internal and external auditor requests.
* Prepare and maintain IT GRC artifacts, including risk registers, control matrices, control narratives, testing records, audit artifacts, remediation trackers, policy inventories, issue logs, and governance dashboards.
* Monitor, analyze, and report on IT GRC KPIs, KRIs, audit issues, control gaps, policy exceptions, remediation progress, overdue items, and emerging areas of concern.
* Partner directly with IT control owners to strengthen control design, improve process documentation, resolve control gaps, and support sustainable remediation of findings.
* Serve as a key working liaison between IT, cybersecurity, internal audit, external audit, enterprise risk, compliance, legal, control owners, and business stakeholders on GRC-related activities.
* Provide hands-on guidance, coaching, task coordination, and quality review for IT GRC analysts, including reviewing evidence, work papers, risk assessments, status updates, and remediation documentation.
* Identify and implement improvements to IT GRC processes, reporting, evidence collection, governance workflows, control monitoring, and audit readiness practices.
* Escalate significant risks, control gaps, overdue remediation items, audit concerns, and governance issues to the AVP of IT Compliance in a timely manner.
* Support IT compliance and governance awareness by helping communicate policy expectations, control responsibilities, risk obligations, and audit readiness requirements across IT.
** Technical Knowledge and Understanding:
*** Strong understanding of IT governance, IT risk management, and IT compliance principles, including how policies, standards, risks, controls, and evidence support regulatory, audit, and business requirements.
* Working knowledge of key frameworks, standards, and regulations such as SOX, NYDFS Cybersecurity Regulation, COBIT, NIST CSF, ISO 27001, COSO, HIPAA, and other applicable requirements.
* Strong understanding of IT General Controls, including access management, privileged access, change management, computer operations, backup and recovery, incident management, system development lifecycle, and third-party technology controls.
* Hands-on knowledge of IT control testing practices, including test planning, evidence review, control performance validation, issue…