IT Governance Analyst

Assists in the identification, assessment, monitoring, and risk mitigation associated with third-party vendors and suppliers. This role serves as a trusted advisor to business stakeholders, procurement teams, information security, legal, and compliance functions to ensure third-party relationships align with the organization's risk appetite and regulatory obligations.

Responsibilities

• Assists with the identification and assessment of risks associated with third-party vendors, suppliers, business partners, and outsourced service providers, with a strong focus on technology, cybersecurity, data privacy, and regulatory risks.
• Provides support to business owners and project teams to increase awareness and understanding of risks and controls and assist in the development, assessment, and monitoring of mitigation plans for IT-related risks, to ensure they are managed to an acceptable level.
• Identifies, evaluates, and escalates issues that conflict with BCBSNC’s risk tolerance.
• Consults on projects and other initiatives to ensure third-party risks are considered and addressed appropriately.
• Assesses the effectiveness of vendor control environments through review of audit reports, certifications, questionnaires, security assessments, and other risk artifacts. Recommends improvements to strengthen risk management practices and reduce exposure.
• Develops metrics, dashboards, and reporting materials that provide management and executive leadership with visibility into third-party risk exposure, emerging risks, remediation activities, and program effectiveness.
• Delivers training, awareness sessions, and stakeholder guidance to promote a strong culture of third-party risk management and ensure consistent application of TPRM requirements across the organization.

Requirements

• Bachelor's degree or advanced degree (where required).
• 3+ years of experience in a related field.
• In lieu of degree, 5+ years of experience in a related field.

Qualifications

• Experience conducting IT audits and supporting SOX (Sarbanes-Oxley) compliance audits.
• Professional certifications such as HITRUST, NIST, SOC 2, and ISO standards preferred.
• Industry-recognized certifications in IT audit, risk management, governance, or compliance, including CISA, CRISC, and CRMA, are a plus.

Benefits

• Medical, dental, and vision coverage along with numerous health and wellness programs.
• Parental leave and support plus adoption and surrogacy assistance.
• Career development programs and tuition reimbursement for continued education.
• 401k match including an annual company contribution.

Pay

Salary range: $81,068.00 - $129,708.00. Starting salaries are typically planned near the middle of the range listed. Compensation decisions are driven by factors including experience and training, specialized skill sets, licensure and certifications, and other business and organizational needs. Base salary is part of a robust Total Rewards package that includes an annual incentive bonus based on annual corporate goal achievement and individual performance, 401(k) with employer match, and paid time off (PTO).

Schedule

Hybrid Flex approach: work in the office at least two days a week for collaboration and connection, with flexibility to work remotely. Remote Flex roles work virtually with a few in-office visits each year for meaningful moments. Onsite expectations will be discussed during the interview process. Candidates from outside the local area and any states listed on the job posting are welcome.