ZipRecruiter

Log In

1

Governance Risk Compliance Jobs in Michigan (NOW HIRING)

Eccalon LLC

Vice President of Cybersecurity

Detroit, MI · Hybrid

$148K - $186K/yr

Governance, Risk & Compliance (GRC) * Lead cybersecurity compliance efforts for government and regulated environments, including NIST 800-53, NIST 800-171, CMMC, and related federal frameworks

Astemo Ltd

IT Governance Senior Manager

Farmington Hills, MI · On-site

$128K - $129K/yr

This role provides executive oversight for IT risk management, controls oversight, policy governance, audit coordination, and remediation management to ensure a strong and compliant operational ...

Pwc

AI Governance Manager

Detroit, MI · On-site

$99K - $297K/yr

Responsibilities - Leading the development and implementation of governance frameworks to manage risk and compliance for clients - Analyzing complex regulatory landscapes to provide strategic advice ...

next page

Showing results 1-20

All JobsGovernance Risk Compliance JobsGovernance Risk Compliance Jobs in Michigan

Governance Risk Compliance information

See Michigan salary details

$27.5K

$59.9K

$97.6K

How much do governance risk compliance jobs pay per year?

As of Jul 27, 2026, the average yearly pay for governance risk compliance in Michigan is $59,906.00, according to ZipRecruiter salary data. Most workers in this role earn between $42,700.00 and $75,400.00 per year, depending on experience, location, and employer.

Is GRC an entry level job?

Governance, Risk, and Compliance (GRC) roles can be entry-level or require experience depending on the specific position. Entry-level GRC jobs typically focus on supporting compliance activities and may require basic knowledge of regulations and tools like audit software, while more advanced roles demand prior experience and specialized certifications.

Is governance risk and compliance a good career?

Governance, Risk, and Compliance (GRC) is a growing field that offers opportunities in managing organizational policies, regulatory requirements, and risk mitigation. It often requires knowledge of industry standards, certifications like CISA or CRISC, and strong analytical skills. The role provides stability and advancement potential in various industries, including finance, healthcare, and technology.

What is the work of governance risk and compliance?

Governance, Risk, and Compliance (GRC) professionals develop and implement policies to ensure organizations adhere to legal and regulatory requirements, manage risks effectively, and maintain ethical standards. They often use tools like risk assessments, audits, and compliance frameworks to identify vulnerabilities and ensure organizational integrity. The role requires strong analytical skills and knowledge of industry regulations.

What Are Jobs in Governance, Risk and Compliance?

Governance risk compliance (GRC) is a method for managing and strategizing an organization's regulations regarding governance, financial or physical risk, and regulatory compliance. It aligns the IT aspects with business objectives and works to improve the efficiency of a company. There are GRC consultants and GRC analysts who provide an assessment of a business’s GRC, identify risks, analyze the data, develop policies to benefit the workplace, and consult on the best choice of action. Your duties may involve optimizing GRC systems, implementing tactics to lower risk, providing internal audits, assisting with cybersecurity, creating routine reports, and ensuring regulatory compliance.

What is the salary of governance risk compliance?

The salary for a Governance, Risk, and Compliance (GRC) professional typically ranges from $70,000 to $130,000 annually, depending on experience, location, and certifications such as CISA or CRISC. Entry-level roles may start lower, while senior positions or those in high-demand industries can earn higher salaries.

What is Governance, Risk, and Compliance (GRC)?

Governance, Risk, and Compliance (GRC) is a coordinated strategy that organizations use to manage overall governance, enterprise risk management, and compliance with regulations and standards. GRC professionals help organizations align their business objectives with risk management practices and regulatory requirements. This role involves identifying potential risks, implementing policies to mitigate those risks, and ensuring that the organization adheres to legal, ethical, and internal standards. Effective GRC management can improve decision-making, optimize processes, and protect the organization from financial or reputational harm.

How does a Governance, Risk, and Compliance (GRC) professional typically collaborate with other departments within an organization?

GRC professionals work closely with a variety of departments, including IT, legal, finance, and operations, to ensure that organizational policies and regulatory requirements are consistently met. Collaboration often involves leading risk assessments, facilitating compliance training, and coordinating audits to identify and mitigate potential risks. Effective communication and relationship-building are key, as GRC teams must translate complex regulations into actionable steps for different business units. This cross-functional approach helps embed a culture of compliance and risk awareness throughout the organization.

What is the difference between Governance Risk Compliance vs Risk Analyst?

AspectGovernance Risk ComplianceRisk Analyst
CertificationsCRISC, CISA, CISSPCFA, FRM, CRISC
Work EnvironmentCorporate, regulated industriesFinancial, consulting firms
Employer & Industry UsageFinancial institutions, healthcare, governmentBanking, investment firms, insurance

Governance Risk Compliance focuses on establishing policies, ensuring regulatory adherence, and managing enterprise-wide risks. Risk Analysts primarily assess specific financial or operational risks through data analysis. While both roles involve risk management, Governance Risk Compliance has a broader scope related to organizational compliance and governance frameworks, whereas Risk Analysts concentrate on analyzing and quantifying particular risks.

What are the key skills and qualifications needed to thrive as a Governance Risk Compliance (GRC) professional, and why are they important?

To thrive as a Governance Risk Compliance professional, you need a solid understanding of regulatory frameworks, risk management principles, and policy development, often supported by a degree in business, law, or information security. Familiarity with GRC software platforms, compliance management systems, and certifications like CISA, CRISC, or CISSP is highly valuable. Strong analytical thinking, attention to detail, and effective communication skills set top performers apart in this field. These competencies are essential for ensuring organizational compliance, minimizing risks, and maintaining robust corporate governance.
More about Governance Risk Compliance jobs
What are the most commonly searched types of Governance Risk Compliance jobs in Michigan? The most popular types of Governance Risk Compliance jobs in Michigan are:
What are popular job titles related to Governance Risk Compliance jobs in Michigan? For Governance Risk Compliance jobs in Michigan, the most frequently searched job titles are:
What job categories do people searching Governance Risk Compliance jobs in Michigan look for? The top searched job categories for Governance Risk Compliance jobs in Michigan are:
What cities in Michigan are hiring for Governance Risk Compliance jobs? Cities in Michigan with the most Governance Risk Compliance job openings:
Governance Risk Compliance jobs near you
Infographic showing various Governance Risk Compliance job openings in Michigan as of July 2026, with employment types broken down into 1% As Needed, 80% Full Time, 14% Part Time, and 5% Contract. Highlights an 94% Physical, 2% Hybrid, and 4% Remote job distribution, with an average salary of $59,906 per year, or $28.8 per hour.
Manager, Information Security Risk and Consulting (REMOTE)

Manager, Information Security Risk and Consulting (REMOTE)

Trinity Health

Livonia, MI • On-site, Remote

Full-time

Posted 11 days ago

Trinity Health rating

6.5

Company rating: 6.5 out of 10

Based on 353 frontline employees who took The Breakroom Quiz

603rd of 890 rated healthcare providers

Job description

Employment Type:
Full timeShift:
Description:
The Manager, Information Security Risk and Consulting, operating under the direction of the Director of Information Security Strategy and Planning, plays a critical role in executing and maturing the organization's third-party and integrated risk management program. This includes oversight of enterprise risk assessments across commercial off-the-shelf (COTS), open source, and internally developed applications, as well as associated system integrations. The role is responsible for identifying, assessing, and prioritizing security risks, ensuring appropriate controls are implemented, and driving continuous monitoring and risk-informed decision-making across the organization.
This position leads the development and reporting of key risk indicators (KRIs) and key performance indicators (KPIs) to provide actionable insights to leadership and support effective governance. Additionally, the role oversees the design and execution of scalable risk management processes, leveraging GRC tools and automation to enhance efficiency and consistency.
As a people leader, the Manager builds, develops, and leads a highly engaged, high-performing team of security risk professionals, fostering a culture of accountability, collaboration, and continuous improvement within a complex and evolving security environment.
Essential Functions
Our Trinity Health Culture: Knows, understands, incorporates & demonstrates our Trinity Health Mission, Values, Vision, Actions & Promise in behaviors, practices & decisions.
Program and Regulatory Compliance
  • Develops and leads Trinity Health's Information Security Third Party Risk and Integrated Risk Management Program, with direct responsibility for defining team goals, scope of work, and deliverables aligned to Enterprise Information Security (EIS) priorities.
  • Partners with stakeholders to ensure initiatives support the organization's mission, values, and operational goals, while maintaining compliance with regulatory, legal, and contractual obligations.
  • Leads the team's engagement in regulatory audit and investigation activities, including the coordination and production of evidence.

People Leadership
  • Responsible for developing and leading a high-performing team of security risk professionals focused on third-party and integrated risk management, risk-based prioritization, and enterprise risk remediation coordination.
  • Provides hands-on leadership and direct supervision of team members, ensuring effective recruitment, performance management, training, and clear accountability for individual and team productivity.
  • Designs and maintains a structured leadership development framework with clear competencies, promotion criteria, and aligned role expectations.
  • Provides ongoing coaching, mentorship, and development planning to prepare employees for advancement while actively promoting psychological safety and open communication.
  • Ensures fair, data-driven evaluations and fosters a collaborative, inclusive leadership culture.
  • Exhibits courageous, authentic leadership-building trust through vulnerability, empathy, and clear, human-centered communication with executives and stakeholders through both formal and informal channels.

Information Security Governance, Risk & Compliance (GRC)
  • Oversees and actively contributes to third-party and integrated risk management activities within Trinity Health GRC platforms, driving continuous process improvement and proactively planning for changes to control frameworks and risk questionnaires.
  • Actively perform and review vendor tiering and risk assessments alongside the team, taking ownership of and/or supporting senior team members through ownership of complex or high-risk cases, as appropriate
  • Define and maintain the third-party cyber risk lifecycle, including intake, inherent risk scoring, due diligence, control assessment, remediation, risk acceptance, ongoing monitoring, renewal review, material change review, and offboarding.
  • Evaluate vendor controls across identity and access management, network security, cloud security, application security, data protection, encryption, vulnerability management, endpoint protection, logging and monitoring, incident response, disaster recovery, secure SDLC, privacy, and governance
  • Review and advise on contractual clauses related to security controls, breach notification, incident cooperation, right to audit, data protection, encryption, access control, regulatory compliance, cyber insurance, subcontractors, business continuity, data retention, and secure data destruction
  • Facilitate and lead offshore security risk compliance program.
  • Translate technical findings into business risk language that enables informed decisions by senior leaders and business owners
  • Prepare materials for audit, regulatory inquiries, board reporting, and internal governance reviews as needed
  • Track deviations from security procedures and standards, document risk implications, drive risk remediation, and route risk acceptance (security policy exceptions) for appropriate approvals.
  • Maintain hands-on involvement in day-to-day assessments to ensure quality, consistency, and timely delivery.
  • Escalate overdue or unacceptable vendor risks through leadership as appropriate.

Metrics and Reporting
  • Works with Strategy and Planning and Enterprise Information Security Leadership to define and report on key risk indicators (KRIs) and key performance indicators (KPIs) to provide actionable insights to leadership and support effective governance.

Information Security Risk Management
  • Responsible for assigning, managing, and actively overseeing team assessment work, ensuring alignment with standards through coordinated intake and stakeholder engagement.
  • Validates team members' risk assessments to ensure new and existing solutions comply with Trinity Health information security requirements.
  • Accountable for balancing workload and ensuring the team is trained and skilled to effectively deliver department services.

Executive & Stakeholder Engagement
  • Builds and sustains effective relationships with executives and key stakeholders through clear, authentic, risk-informed communication; enables alignment, drives informed decision-making, and fosters shared accountability for managing security risk.

Enterprise Risk Communication & Decision Support
  • Synthesizes and communicates enterprise security risk insights to executives and stakeholders in a clear, actionable manner; translates complex risk data into meaningful narratives that support informed decision-making, drive prioritization, and strengthen governance and alignment with organizational objectives.

Information Security Leadership Support
  • Serves as a representative of the Director of Strategy and Planning as directed. Supports Information Security leadership by providing risk-informed insights, actionable recommendations, and clear communication to enable strategic decision-making, program prioritization, and alignment with organizational objectives.

Security Leadership & Coordination
  • Leads and coordinates engagement with Enterprise Information Security leadership to ensure aligned execution of security and risk management activities, including policy and standards development, control assessments, and risk management education; drives collaboration, consistency, and integration of security practices across the organization.

Regulatory & Standards Monitoring
  • Maintains a working knowledge of applicable Federal, State, and local laws and regulations, the Trinity Health Integrity and Compliance Program and Code of Conduct, and relevant policies and procedures, while staying current with industry developments and regulatory changes to ensure updates are reflected and adherence is upheld with honest, ethical, and professional behavior.

Project Management
  • Provides leadership and oversight of security risk initiatives, ensuring successful delivery and alignment with organizational standards and risk management objectives.
  • Leads and develops team members managing projects, ensuring consistent execution, accountability, and high-quality outcomes.
  • Partners with stakeholders and senior leadership to align priorities, communicate status, and drive strategic outcomes.
  • Proactively identifies risks and ensures effective mitigation to keep initiatives on track and meet organizational expectations.

Relationship Management
  • Develops and manages relationships to ensure stakeholders are actively engaged throughout the project, program, or initiative life cycle.
  • Works with stakeholders to ensure business process workflows; training and communication plans are completed.
  • Provides appropriate tools, training, guidance, and necessary resources to resolve problems, avert potential risks and maintain engagement to support risk avoidance, risk remediation and empower champions of information security best practices throughout the organization.

Minimum Qualifications
  • Bachelor's degree in Information Security or an equivalent combination of education and experience.
  • One or more security certifications: Certified Information Systems Security Professional (CISSP), International Social Security Association (ISSA), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC) Certified in Governance, Risk and Compliance (GRCP) or equivalent.
  • Minimum of seven (7) years of progressive experience in information services including three (3) years working in cybersecurity governance, risk, and compliance (GRC).
  • Minimum of three (3) years of management experience with demonstrated leadership effectiveness and emotional intelligence. Proven ability to lead, develop, and retain high-performing, highly engaged teams in complex security environments, including managing diverse talent and implementing tailored development strategies to drive individual and team success.
  • Minimum of three (3) years of progressively responsible experience in healthcare and/or other regulated industries. Preferred candidates will have experience in complex healthcare environments with a strong understanding of operational workflows, information practices, and information systems.
  • Strong knowledge of the HIPAA Security Rule and applicable industry security regulations, with the ability to rapidly build and sustain expertise; working understanding of broader HIPAA requirements, including Privacy and Breach Notification Rules.
  • Proven knowledge of enterprise security principles and practices, with hands-on experience or demonstrated capability in implementing, integrating, and managing security solutions across enterprise environments.
  • Working knowledge of one or more information security regulations and/or frameworks - HIPAA, ISO 27001/2, FISMA, FIPS, HITRUST and NIST security.
  • Experience with GRC platforms (e.g., ServiceNow GRC, RSA Archer, OneTrust, or similar) supporting risk and compliance programs. Demonstrated ability to leverage tooling to improve process efficiency, enable reporting, and support scalable risk management practices.
  • Ability to serve as a leadership representative of the Strategy and Planning Director and interface with a variety of Health Ministry and System Office Executive leaders, team members and end users, exercising effective facilitation skills, judgment, and decision-making in providing problem resolution and in meeting established goals and expectations. Ability to shape results, garner support and successfully manage complex relationships.
  • Demonstrated courageous, authentic leadership through clear, human-centered communication with senior leaders and stakeholders; builds trust through empathy and vulnerability while skillfully navigating complex conversations, influencing decisions, and delivering compelling, accessible messages in both formal and informal settings.
  • Excellent oral and written communication skills. Facilitates meetings between diverse groups and interests and prepare communications that includes independent advisory recommendations. Ability to communicate with non-technical leaders and business owners providing a clear understanding of appropriate technology solutions to support and enhance business needs.
  • Proficiency in performing third-party risk assessments and negotiating contractual security language
  • Proven ability to apply appropriate project management methodology. Excellent project leadership, organization, integration, and execution skills required.
  • Knowledge of and experience with change control, risk management, project planning, relationship management, budgeting, and scheduling.
  • Ability to operate in an ambiguous and highly matrix organizational structure. Ability to manage multiple and ever-changing priorities in a highly autonomous self-directed manner.
  • Some knowledge of and experience with clinical application systems (i.e., hospital work environment, technical terminology, etc.).
  • Considerable knowledge of multiple technologies and experience with enterprise-wide applications and systems in an integrated work environment.
  • Proven ability to operate with speed and focus, driving measurable value through high-quality delivery of time-sensitive initiatives.

Preferred Qualifications
  • Master's degree in Cybersecurity or related field from an accredited college/university
  • Two or more Certification(s) in project management, change management, information security, and/or information technology.
  • Experience with risk quantification models (e.g. FAIR) or building custom risk scoring approaches.
  • Familiarity with data visualization tools (e.g., Tableau, Power BI) for building risk dashboards
  • Experience working cross-functionally to evaluate security controls and business processes, translating findings into meaningful risk insights
  • Experience in managing risk in a healthcare e

What Trinity Health employees say

Pay

Benefits

Hours and flexibility

Workplace

Get the full story on Breakroom

Trinity Health logo

About Trinity Health

Sourced by ZipRecruiter

Trinity Health Ann Arbor is a 537 -bed teaching hospital located on 340 acre campus. Recognized by IBM Watson as a Top 100 Hospital and #1 Teaching Hospital, Trinity Health Ann Arbor has been a leading health care provider for more than 100 years. Trinity Health has received numerous local and national awards in recognition of our leadership, quality outcomes, and clinical excellence.

Industry

Health care and social assistance

Company size

10,000+ Employees

Headquarters location

Livonia, MI, US

View All Trinity Health Jobs

Apply