Senior IT GRC Advisor

About CCNC: From the mountains to the coast, from large cities to small towns, Community Care of North Carolina is transforming health care. Informed by statewide data and predictive analytics, community-based care-managers work with local physicians and diverse teams of health professionals to develop whole-person plans of care that connect people to the right local resources and increase equity and access to high quality care. CCNC Mission Statement To improve the health and quality of life for all North Carolinians by building supporting better community-based healthcare delivery systems. Position Summary The Senior IT GRC Advisor is responsible for leading and maturing CCNC s enterprise IT governance, risk, and compliance program. This role serves as a senior advisor to leadership and works in alignment with IT security and IT leadership on IT risk, cybersecurity governance, internal controls, regulatory obligations, and audit readiness, while maintaining practical, business-aligned processes that strengthen the control environment across infrastructure, applications, cloud platforms, vendors, data protection, and strategic technology initiatives. The Senior IT GRC Advisor is accountable for the development, implementation, and continuous improvement of IT GRC methodologies, policies, standards, risk assessments, issue management, reporting, and advisory services that support secure and compliant operations. Essential Functions Lead the enterprise IT GRC program, including governance structures, risk management processes, policy oversight, control framework alignment, and reporting on program effectiveness to leadership. De monstrate strong critical thinking and professional skepticism to assess control design and operating effectiveness, analyze requirements, data, and processes in context, and provide defensible, risk-based recommendations to management. Plan, lead, and execute IT risk assessments, audits, and advisory engagements across infrastructure, applications, cloud services, cybersecurity processes, data protection controls, and enterprise technology initiatives. Develop, maintain, and mature the IT risk register and issue management process, including documenting risks, assigning ownership, tracking remediation plans, validating closure, and reporting residual risk and trends to leadership. Establish and maintain GRC metrics, dashboards, KPIs, and KRIs to provide leadership with meaningful visibility into control effectiveness, audit