GRC Issue Management Specialist | Privacy Security RMS | Full Time

About the Role:

The Issue Management Specialist supports the enterprise cybersecurity and technology risk issue management function within the Controls Management program. This role is responsible for the day-to-day execution of issue management activities, ensuring that identified security, privacy, and technology control issues are accurately documented, tracked, monitored, validated, and closed in accordance with established governance standards and regulatory expectations. Reporting to the Supervisor, GRC Issue Management, the Issue Management Specialist partners with Cybersecurity GRC, Internal Audit, Privacy, Compliance, IT, and business stakeholders to support timely and effective remediation of issues identified through audits, risk assessments, control testing, regulatory reviews, incidents, and other assurance activities. This role is operational and execution-focused, emphasizing discipline, accuracy, coordination, and follow-through rather than program ownership or people management.

Core competencies include:

• Technical Issue & Remediation Analysis
• Cybersecurity & IT Control Knowledge
• Issue Intake, Documentation, and Lifecycle Tracking
• Remediation Monitoring and Technical Evidence Validation; Risk & Control Interpretation
• Cross Functional Coordination with Technical Teams
• Reporting Accuracy and Data Quality
• Process Adherence and Continuous Improvement.

PRINCIPLE DUTIES AND RESPONSIBILITIES:

• Support the end-to-end lifecycle of cybersecurity, privacy, and technology risk issues, including documentation, technical analysis, remediation tracking, validation, and closure.
• Translate technical control failures, design gaps, and operational deficiencies into clearly articulated issues within the GRC platform.
• Assist with intake and coordination of issues originating from audits, technical assessments, penetration tests, control testing, regulatory reviews, incidents, and third-party risk activities.
• Partner with technical control owners to understand system architectures, security controls, and remediation approaches.
• Track remediation activities against defined action plans and timelines, following up with IT and cybersecurity teams to ensure progress and clarity.
• Perform technical review of remediation evidence, such as:
• Security tool outputs (e.g., vulnerability scans, configuration baselines)
• System configurations and screenshots
• Access control reviews
• Policy and technical standard updates tied to control implementation
• Validate that remediation actions adequately address the root cause and risk intent of the issue prior to closure.
• Escalate overdue items, remediation risks, or insufficient technical evidence to the Supervisor, GRC Issue Management.
• Ensure consistent issue categorization, control mapping, and risk attribution aligned with frameworks such as NIST, HITRUST, ISO, PCI, or HIPAA.
• Support audit and regulatory readiness through accurate issue status reporting and evidence coordination.
• Assist in preparing detailed issue metrics, trend analysis, and technical commentary for leadership and governance forums.
• Contribute to continuous improvement of issue management processes, particularly where clarity around technical controls and remediation quality can be improved.
• Perform other duties as assigned