Overview
The Senior IT GRC Analyst helps advance the organization's approach to technology and data risk by connecting governance, compliance, and security practices with business objectives. The role leads key aspects of IT SOX and third-party risk management, advises stakeholders on effective control design, and supports security leadership in building scalable, risk-based GRC and data security programs focused on reducing key areas of data exposure and protecting sensitive information.
Responsibilities What You'll Do
Essential Functions/Primary Responsibilities:
- IT Risk Management Program:
- Assist the security leader in developing risk assessment and reporting tools that help prioritize resources and initiatives based on business impact, threat exposure, regulatory requirements, and organizational risk appetite.
- Assist in development and generation of meaningful risk and compliance metrics, and reporting that provides leadership with visibility into control effectiveness, risk exposure, remediation progress, third-party risk, and emerging trends.
- Assist in the performance of maturity assessments against accepted frameworks such as NIST CSF.
- SOX and Other Compliance Programs:
- Partner with IT control owners, Internal Audit, External Audit, Finance, and business stakeholders to coordinate the annual IT SOX lifecycle. This includes risk assessments, control scoping, testing readiness, evidence coordination, deficiency evaluation, remediation tracking, and management reporting.
- Support the design, documentation, monitoring, and continuous improvement of IT General Controls (ITGCs) and other technology controls supporting financial reporting.
- Support internal and external audits, regulatory inquiries, and customer or third-party assurance activities by coordinating responses, validating evidence, and ensuring identified issues are appropriately addressed.
- IT Governance and Controls:
- Support the development, maintenance, and lifecycle management of IT and information security policies and standards, partnering with stakeholders to ensure requirements are clear, risk-aligned, appropriately governed, and periodically reviewed.
- Provide control advisory support to technology teams, helping translate regulatory, audit, security, and risk requirements into practical, appropriately designed controls. This includes advising on control design for new systems, significant system changes, implementations, integrations, and evolving business processes, promoting a controls-by-design approach.
- Identify opportunities to simplify, standardize, automate, and strengthen controls while balancing compliance requirements with operational efficiency and business objectives.
- Cyber TPRM Program:
- Execute the organization's Cyber Third-Party Risk Management (TPRM) program, including vendor risk assessments, issue identification, and ongoing monitoring activities.
- Partner with groups inside and outside of IT to ensure third-party technology and security risks are appropriately identified, evaluated, accepted, mitigated, and monitored throughout the vendor lifecycle.
- Data Security Program:
- Assist Information Security leadership to define risk-based requirements for a Critical Data Protection & Monitoring program, including capabilities required for tooling.
- Deploy and tune monitoring capabilities to detect and respond to key data security risks, including data exfiltration, unauthorized or over-privileged access, inappropriate data sharing, sensitive data exposure, anomalous data movement, and privilege misuse, leveraging targeted monitoring and guardrails where appropriate.
Qualifications What You'll Bring
- Bachelor's Degree in related field or equivalent work experience
- 3-5 years' experience in GRC, TPRM, SOX, Risk Management.
- SAP, Azure, Industrial Control Systems (ICS) experience preferred
- Professional certification such as CISA, CRISC, CISSP, CISM, CGEIT, or CIA, or demonstrated progress toward a relevant certification preferred.
- Experience in a publicly traded company or other environment subject to SOX, external audit, and formalized IT control requirements.
Working Conditions/Environment
Working Conditions/Environment:
Works in a normal office environment where the employee is regularly required to speak, see, hear, sit, stand, talk, type, walk and bend while moving about the facility. The noise level in the office is quiet. Occasional travel to plants or meetings is required.
About Us
The Marzetti Company (Nasdaq: MZTI) manufactures and sells specialty food products. Our retail brands include Marzetti dressings and dips, New York Bakery garlic breads, and Sister Schubert's dinner rolls, in addition to exclusive license agreements for Olive Garden dressings, Chick-fil-A sauces and dressings, Buffalo Wild Wings sauces, Arby's sauces, Subway sauces, and Texas Roadhouse steak sauces and frozen rolls. Our foodservice business supplies sauces, dressings, breads, and pasta to many of the top restaurant chains in the United States.
At Marzetti, our mission is to make every meal better through high-quality, flavorful food. Led by our purpose, to nourish growth with all that we do, our team members are dedicated to creating great tasting food and cultivating deep and lasting relationships.