Senior IT GRC Analyst

Why Marzetti?

At The Marzetti Company, we empower our people and nourish their potential.  Find community, be appreciated, experience growth and make an impact as part of our team!

We offer competitive benefits including:

• Health and life insurance plans
• Retirement savings benefits
• Paid parental leave and paid time off
• Tuition assistance
• Well-being incentives and on-site health care screenings
• Mental health benefits

A full list of benefits can be found here https://careers.marzetticompany.com/benefits

Role Overview

The Senior IT GRC Analyst helps advance the organization’s approach to technology and data risk by connecting governance, compliance, and security practices with businessobjectives. The role leads key aspects of IT SOX and third-party risk management, advises stakeholders on effective control design, and supports security leadership in building scalable, risk-based GRC and data security programs focused on reducing key areas of data exposure and protecting sensitive information.

Responsibilities → What You'll Do

Essential Functions/Primary Responsibilities:

• IT Risk Management Program:

• Assistthe security leader in developing risk assessment and reporting tools that help prioritize resources and initiatives based on business impact, threat exposure, regulatory requirements, and organizational risk appetite.

• Assistin development and generation of meaningful risk and compliance metrics, and reporting that provides leadership with visibility into control effectiveness, risk exposure, remediation progress, third-party risk, and emerging trends.

• Assistin the performance of maturity assessments against accepted frameworks such as NIST CSF.

• SOX and Other Compliance Programs:

• Partner with IT control owners, Internal Audit, External Audit, Finance, and business stakeholders to coordinate the annual IT SOX lifecycle. This includes risk assessments, control scoping, testing readiness,evidencecoordination, deficiency evaluation, remediation tracking, and management reporting.

• Support the design, documentation, monitoring, and continuous improvement of IT General Controls (ITGCs) and other technology controls supporting financial reporting.

• Support internal and external audits, regulatory inquiries, and customer or third-party assurance activities by coordinating responses,validatingevidence, and ensuring identified issues are appropriately addressed.

• IT Governance and Controls:

• Support the development, maintenance, and lifecycle management of IT and information security policies and standards, partnering with stakeholders to ensure requirements are clear, risk-aligned, appropriately governed, and periodically reviewed.

• Provide control advisory support to technology teams, helping translate regulatory, audit, security, and risk requirements into practical, appropriately designed controls. This includesadvising oncontrol designfor new systems, significant system changes, implementations, integrations, and evolving business processes, promoting a controls-by-design approach.

• Identifyopportunities to simplify, standardize, automate, and strengthen controls while balancing compliance requirements with operational efficiency and businessobjectives.

• Cyber TPRM Program:

• Execute the organization's Cyber Third-Party Risk Management (TPRM) program, including vendor risk assessments, issue identification, and ongoing monitoring activities.

• Partner with groups inside and outside of IT to ensure third-party technology and security risks are appropriatelyidentified, evaluated, accepted, mitigated, andmonitoredthroughout the vendor lifecycle.

• Data Security Program:

• Assist Information Security leadership to define risk-based requirements for a Critical Data Protection & Monitoring program, including capabilities required for tooling.

• Deploy and tune monitoring capabilities to detect and respond to key data security risks, including data exfiltration, unauthorized or over-privileged access, inappropriate data sharing, sensitive data exposure, anomalous data movement, and privilege misuse,leveragingtargeted monitoring and guardrails whereappropriate.

How you'll do it

The successful candidate will put our values into practice every day:

Hunger​.  I come ready, pay attention, and refuse to settle for getting by when getting better is possible.​

Respect​.  I know my people by name, show up for them as humans, and never make anyone feel small.​

Courage​.  I say the hard thing, own my mistakes, and carry my team’s voice forward.​

Humility​.  I ask before I assume, learn from those around me, and lead with curiosity over ego.​

Qualifications → What You'll Bring

The Senior IT GRC Analyst helps advance the organization’s approach to technology and data risk by connecting governance, compliance, and security practices with business objectives. The role leads key aspects of IT SOX and third-party risk management, advises stakeholders on effective control design, and supports security leadership in building scalable, risk-based GRC and data security programs focused on reducing key areas of data exposure and protecting sensitive information. 
Who we are

The Marzetti Company manufactures and sells specialty food products. Our retail brands include Marzetti, New York Bakery, Sister Schubert’s and Bachan’s, in addition to exclusive license agreements with Olive Garden, Chick-fil-A, Buffalo Wild Wings and Texas Roadhouse. Our foodservice business supplies sauces, dressings, breads, and pasta to many of the top restaurant chains in the United States.

At Marzetti, our mission is to Make Every Meal Better. We are a spirited blend of tradition and innovation—real people crafting real flavor. We’re not just a team; we’re a promise—a commitment to craft, care, and create a legacy.

Working Conditions

Working Conditions/Environment:

Works in a normal office environment where the employeeis regularly required tospeak, see, hear, sit, stand, talk, type,walkand bend while moving about the facility. The noise level in the office is quiet. Occasional travel to plants or meetings isrequired.