Senior IT GRC Advisor

Community Care of North Carolina Inc•Garner, NC

About The Position

The Senior IT GRC Advisor leads and matures Community Care of North Carolina’s enterprise IT governance, risk, and compliance program. The role advises leadership and works with IT security and IT leadership on IT risk, cybersecurity governance, internal controls, regulatory obligations, and audit readiness. It maintains practical, business-aligned processes to strengthen controls across infrastructure, applications, cloud platforms, vendors, data protection, and strategic technology initiatives. The advisor develops, implements, and continually improves IT GRC methodologies, policies, standards, risk assessments, issue management, reporting, and advisory services that support secure and compliant operations. The role also supports third-party risk management, cloud and SaaS compliance, identity and access management, audit preparedness, workforce education, business continuity and incident-response control reviews, and responsible AI governance.

Requirements

Bachelor’s degree in information technology, cybersecurity, information systems, accounting, audit, risk management, or a related field.
At least 7 years of progressive experience in IT audit, IT risk management, cybersecurity compliance, or GRC program leadership.
Demonstrated experience planning and leading complex IT audit, risk assessment, or advisory engagements.
Experience developing or maturing GRC programs, frameworks, policies, risk registers, metrics, or issue management processes.
Experience assessing third-party and vendor risk and reviewing assurance artifacts such as SOC reports, penetration tests, and security certifications.
Experience conducting cloud risk or compliance assessments in AWS, Azure, or similar environments.
At least one of the following certifications is required: CISA, CISSP, CISM, CRISC, CGEIT, CDPSE, or equivalent.
Knowledge of enterprise IT governance, risk management, and compliance principles; IT general controls, internal control frameworks, and audit methodologies.
Knowledge of cybersecurity concepts, including identity and access management, vulnerability management, incident response, disaster recovery, business continuity, and cloud security.
Knowledge of healthcare security and privacy requirements, including HIPAA Security Rule concepts.
Knowledge of third-party and vendor risk management, policy and procedure development, issue management, remediation tracking, and continuous improvement.
Knowledge of recognized frameworks and standards such as NIST CSF, NIST 800-53, COBIT, ISO 27001, PCI DSS, and HITRUST.
Skills in leading IT risk assessments, audits, and advisory engagements; evaluating control design and operating effectiveness; and identifying gaps and remediation priorities.
Skills in maintaining risk registers, issue logs, corrective action plans, and supporting documentation; reviewing vendor assurance artifacts; and drafting policies, standards, and procedures.
Skills in preparing dashboards, executive reports, KPIs, KRIs, and risk summaries; facilitating interviews, walkthroughs, stakeholder meetings, and remediation follow-up; and assessing cloud, access management, and identity governance controls.
Clear written and verbal communication with technical and non-technical audiences.
Ability to analyze complex information, processes, and control environments; exercise sound judgment and professional skepticism; and develop practical, risk-based recommendations.
Ability to influence and collaborate with leaders and cross-functional stakeholders, manage multiple priorities with minimal supervision, and translate technical and regulatory requirements into business-friendly guidance.
Ability to support audit readiness and continuous improvement, identify emerging risks involving third parties, cloud environments, data protection, and AI governance, and maintain confidentiality when handling sensitive information.
Ability to utilize office equipment, computer, keyboard, and phone, with or without assistive devices.
Ability to tolerate sitting for moderate periods and perform repetitive wrist motion; occasional lifting or carrying of up to 25 pounds.

Nice To Haves

Working knowledge of the HIPAA Security Rule and recognized security practices relevant to safeguarding ePHI.
Experience with AI governance, AI risk assessments, or AI assurance reviews.
Experience in continuous controls monitoring, executive reporting, and program maturity improvement.
Experience in healthcare, regulated environments, or privacy and security compliance programs.

Responsibilities

Lead the enterprise IT GRC program, including governance structures, risk management processes, policy oversight, control framework alignment, and reporting on program effectiveness to leadership.
Assess control design and operating effectiveness, analyze requirements, data, and processes, and provide defensible, risk-based recommendations to management.
Plan, lead, and execute IT risk assessments, audits, and advisory engagements across infrastructure, applications, cloud services, cybersecurity processes, data protection controls, and enterprise technology initiatives.
Develop and maintain the IT risk register and issue management process, including documenting risks, assigning ownership, tracking remediation plans, validating closure, and reporting residual risk and trends.
Establish and maintain GRC metrics, dashboards, KPIs, and KRIs that provide leadership visibility into control effectiveness, audit readiness, remediation status, and emerging risk trends.
Collaborate with IT, Security, Privacy, Legal, Compliance, Internal Audit, and business stakeholders to strengthen internal controls and implement corrective and preventive actions.
Advise on enterprise projects, system implementations, and technology changes by embedding risk, compliance, control, and governance requirements throughout the project and system lifecycle.
Lead third-party and vendor risk management, including due diligence, control reviews, evidence evaluation, contract and security requirement alignment, ongoing monitoring, and escalation of material risks.
Assess third-party controls and assurance artifacts, including SOC reports, HITRUST certifications, penetration testing results, and policy documentation.
Conduct cloud and SaaS compliance assessments, including assessments of shared responsibility, configuration governance, access management, identity governance, and security-control evidence.
Evaluate identity and access management controls, including privileged access management, role-based access control, user provisioning and deprovisioning, and workforce access appropriateness.
Support internal and external audits, regulatory reviews, and control assessments by coordinating evidence, validating remediation, and improving documentation quality and audit readiness.
Assess IT and security policies, standards, procedures, and governance artifacts for alignment with recognized frameworks and regulatory expectations, and recommend ways to address gaps.
Develop and facilitate workforce education and awareness programs related to security, privacy, compliance, and internal controls.
Coordinate with operational and technical teams to evaluate incident response, disaster recovery, and business continuity control design and testing from a GRC perspective.
Support responsible AI governance and AI assurance by assessing governance structures, usage controls, risk mitigation, and emerging compliance expectations.
Develop and maintain GRC methodologies, templates, repositories, internal sites, and reporting artifacts to improve consistency, efficiency, and program maturity.
Fulfill other GRC responsibilities as assigned by management.