Qureos Mentor

Crane Company

<div>The Senior IT Governance, Risk &amp; Compliance (GRC) professional is responsible for establishing, overseeing, and continuously improving the organization&rsquo;s IT governance framework to ensure alignment with business objectives, regulatory requirements, and industry best practices. This role leads enterprise ‑ wide IT risk management, compliance, and control activities, including policy ownership, control design, risk assessments, audit coordination, and remediation oversight across business units and technology domains. Acting as a trusted advisor to IT leadership, business stakeholders, and audit partners, the Senior IT GRC role drives consistency, accountability, and transparency in how IT risks are identified, managed, and reported, while supporting compliance with regulatory, contractual, and internal control requirements in a complex, decentralized environment.
Responsibilities and Duties:
<ul><li>Identify, monitor, and support activities responsible for validating the effectiveness of IT security, governance, risk, and compliance programs.
</li><li>Support alignment between IT and audit activities while ensuring adherence to adopted standards, frameworks, and methodologies.
</li><li>Evolve the enterprise IT GRC roadmap, driving continuous improvement in governance maturity, risk visibility, and control effectiveness across the organization.
</li><li>Develop and provide guidance for advisory reviews related to system implementations, technology strategies, mergers and acquisitions, fraud events, and service interruptions.
</li><li>Contribute to a sustainable IT general control environment through involvement in key IT internal control and governance activities.
</li><li>Coordinate with Business Units to align controls with enterprise IT policies, standards, trends, and best practices.
</li><li>Support internal and external audit activities related to IT governance by assisting with policies, narratives, evidence expectations, and self-assessment documentation.
</li><li>Participate in IT risk assessment activities, including third party and service provider risk reviews, and contribute to broader risk management, compliance, and internal control initiatives as needed.
</li><li>Serve as a subject matter resource to support the identification and assessment of IT risks and to improve the effectiveness and efficiency of IT controls.
</li><li>Identify and recommend opportunities for improved governance processes and technology-based tools to support risk mitigation and compliance oversight.
</li><li>Support the development and maintenance of enterprise IT governance policies, standards, procedures, and control requirements to assure compliance with applicable regulatory, audit, and contractual obligations, as well as sound business practices.
</li><li>Review Business Unit certifications and submissions, identify variances, and support the development of remediation actions in coordination with BU leadership.
</li><li>Support formal IT risk analysis and self‑assessment activities for systems, processes, and services, including global asset risk and obsolescence considerations.
</li><li>Contribute to continuity governance and risk mitigation activities related to disaster recovery, backup and recovery practices, and system lifecycle management.
</li><li>Support the development, implementation, and monitoring of compliance oversight activities related to ITAR/DFARS, PCI, data privacy regulations (e.g., GDPR, CCPA), and contractual, licensing, and usage requirements, where governance remains centralized.
</li><li>Liaise with Internal Audit, Corporate Compliance, Legal, and Business Unit IT leadership to support IT governance, risk, and compliance initiatives and audit activities.
</li><li>Monitor IT‑related regulatory, compliance, and legal trends and support the communication of relevant impacts and expectations across the organization.
</li><li>Assist with training and awareness activities for IT staff and Business Units related to IT governance, risk management, and compliance expectations, as needed.
</li></ul>Qualifications and Competencies:
<ul><li>Bachelor&rsquo;s degree in a related field such as Computer Science, Information Technology, or a related discipline.
</li><li>5 + years of experience in an IT GRC or related field required.
</li><li>Risk‑ or audit‑related professional certifications preferred, such as Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT), or Certificate of the Business Continuity Institute (CBCI), or equivalent demonstrated experience.
</li><li>Demonstrated experience supporting compliance with Sarbanes‑Oxley (SOX) IT General Controls, including control design, testing coordination, evidence management, and remediation oversight in partnership with Internal and External Audit.
</li><li>Proven knowledge of DFARS and ITAR regulatory requirements as they apply to information systems, data protection, access controls, and service providers, with experience supporting assessments, contractual requirements, and control enforcement across business units.
</li><li>Demonstrated experience supporting enterprise data privacy programs, including the interpretation and application of global privacy regulations such as GDPR and CCPA, participation in data privacy impact assessments (DPIAs), and oversight of privacy‑related controls within IT governance frameworks.
</li><li>Proven ability to partner with Legal, Information Security, Internal Audit, and business stakeholders to assess privacy risks, support contractual and vendor privacy requirements, and ensure appropriate handling, protection, and retention of personal data across systems and service providers.
</li><li>Demonstrated experience providing governance, risk, and compliance oversight for IT resiliency, backup, and recovery programs, including policy development, control definition, risk assessments, and validation of recovery readiness.
</li><li>Proven ability to oversee backup and disaster recovery control effectiveness, including immutability, retention, encryption, and restoration testing, while coordinating evidence, certifications, and remediation activities with Business Units, Information Security, and Internal Audit.
</li><li>Experience operating within a centralized model while enabling consistent execution and compliance across decentralized business units.
</li><li>Experience or working knowledge of IT governance and compliance frameworks such as COSO, ISO 27001, PCI‑DSS, COBIT, and ITIL.
</li><li>Strong analytical and assessment skills with experience supporting IT risk assessments, audits, or compliance activities across a variety of technologies and platforms.
</li></ul>This description has been designed to indicate the general nature and level of work being performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities, and qualifications required of employees assigned to this job.
Crane Company. is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment and will not be discriminated against on the basis of race, color, religion, gender, sexual orientation, general identity, national origin, disability or veteran status.</div>

Sr. Analyst, IT Governance, Risk & Compliance

Join Crane Company and explore 1   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

Crane Company

About Company

Sr. Analyst, IT Governance, Risk & Compliance