ZipRecruiter

Log In

1

Governance Risk Compliance Jobs in Philadelphia, PA

Utilities One

Risk Compliance Manager

Moorestown, NJ · On-site

$100 - $125/hr

Department: Governance & Administration Employment Type: Full Time Location: United States ... Design and deliver risk awareness, safety, and compliance training programs for staff. Skills ...

Caresoft Inc.

HR Risk & Compliance

Wilmington, DE · On-site

$32 - $33/hr

Title: HR Risk & Compliance Location: 6 Months Duration: Wilmington, DE Duties: Help client to ... and Vendor Governance. Skills: We're looking for a contingent worker to support our team with ...

next page

Showing results 1-20

All JobsGovernance Risk Compliance JobsGovernance Risk Compliance Jobs in Philadelphia, PA

Governance Risk Compliance information

See Philadelphia, PA salary details

$31.8K

$69.4K

$113K

How much do governance risk compliance jobs pay per year?

As of Sep 7, 2026, the average yearly pay for governance risk compliance in Philadelphia, PA is $69,356.00, according to ZipRecruiter salary data. Most workers in this role earn between $49,400.00 and $87,300.00 per year, depending on experience, location, and employer.

What is governance risk compliance?

Governance, Risk, and Compliance (GRC) is a coordinated strategy that organizations use to manage overall governance, enterprise risk management, and compliance with regulations and standards. GRC professionals help organizations align their business objectives with risk management practices and regulatory requirements. This role involves identifying potential risks, implementing policies to mitigate those risks, and ensuring that the organization adheres to legal, ethical, and internal standards. Effective GRC management can improve decision-making, optimize processes, and protect the organization from financial or reputational harm.

What are jobs in governance risk compliance?

Governance risk compliance (GRC) is a method for managing and strategizing an organization's regulations regarding governance, financial or physical risk, and regulatory compliance. It aligns the IT aspects with business objectives and works to improve the efficiency of a company. There are GRC consultants and GRC analysts who provide an assessment of a business’s GRC, identify risks, analyze the data, develop policies to benefit the workplace, and consult on the best choice of action. Your duties may involve optimizing GRC systems, implementing tactics to lower risk, providing internal audits, assisting with cybersecurity, creating routine reports, and ensuring regulatory compliance.

What are the key skills and qualifications needed to thrive as a governance risk compliance professional?

To thrive as a Governance Risk Compliance professional, you need a solid understanding of regulatory frameworks, risk management principles, and policy development, often supported by a degree in business, law, or information security. Familiarity with GRC software platforms, compliance management systems, and certifications like CISA, CRISC, or CISSP is highly valuable. Strong analytical thinking, attention to detail, and effective communication skills set top performers apart in this field. These competencies are essential for ensuring organizational compliance, minimizing risks, and maintaining robust corporate governance.

How does a governance risk compliance professional typically collaborate with other departments within an organization?

GRC professionals work closely with a variety of departments, including IT, legal, finance, and operations, to ensure that organizational policies and regulatory requirements are consistently met. Collaboration often involves leading risk assessments, facilitating compliance training, and coordinating audits to identify and mitigate potential risks. Effective communication and relationship-building are key, as GRC teams must translate complex regulations into actionable steps for different business units. This cross-functional approach helps embed a culture of compliance and risk awareness throughout the organization.

What is the difference between Governance Risk Compliance vs Risk Analyst?

AspectGovernance Risk ComplianceRisk Analyst
CertificationsCRISC, CISA, CISSPCFA, FRM, CRISC
Work EnvironmentCorporate, regulated industriesFinancial, consulting firms
Employer & Industry UsageFinancial institutions, healthcare, governmentBanking, investment firms, insurance

Governance Risk Compliance focuses on establishing policies, ensuring regulatory adherence, and managing enterprise-wide risks. Risk Analysts primarily assess specific financial or operational risks through data analysis. While both roles involve risk management, Governance Risk Compliance has a broader scope related to organizational compliance and governance frameworks, whereas Risk Analysts concentrate on analyzing and quantifying particular risks.

What is the work of governance risk compliance?

Governance, Risk, and Compliance (GRC) professionals develop and implement policies to ensure organizations adhere to legal and regulatory requirements, manage risks, and maintain ethical standards. They analyze business processes, conduct audits, and use tools like risk management software to identify vulnerabilities and ensure compliance across departments.
More about Governance Risk Compliance jobs

What are the most commonly searched types of Governance Risk Compliance jobs in Philadelphia, PA?

The most popular types of Governance Risk Compliance jobs in Philadelphia, PA are:

What are popular job titles related to Governance Risk Compliance jobs in Philadelphia, PA?

For Governance Risk Compliance jobs in Philadelphia, PA, the most frequently searched job titles are:

What job categories do people searching Governance Risk Compliance jobs in Philadelphia, PA look for?

The top searched job categories for Governance Risk Compliance jobs in Philadelphia, PA are:

What cities near Philadelphia, PA are hiring for Governance Risk Compliance jobs?

Cities near Philadelphia, PA with the most Governance Risk Compliance job openings:

Governance Risk Compliance jobs near you
Infographic showing various Governance Risk Compliance job openings in Philadelphia, PA as of August 2026, with employment types broken down into 1% As Needed, 82% Full Time, 13% Part Time, and 4% Contract. Highlights an 93% Physical, 2% Hybrid, and 5% Remote job distribution, with an average salary of $69,356 per year, or $33.3 per hour.

Manager, IT Governance, Risk & Compliance

The Institutes

Malvern, PA • On-site

Full-time

Medical, Dental, Vision, Retirement, PTO

Posted 15 days ago

Job description

About The Institutes
Located in beautiful Malvern, Pennsylvania, The Institutes® are a not-for-profit comprised of diverse affiliates that educate, elevate, and connect people in the essential disciplines of risk management and insurance. Through products and services offered by our nearly 20 affiliated business units, people and organizations are empowered to help those in need with a focus on understanding, predicting, and preventing losses to create a more resilient world.
Additionally, we understand the importance of work-life balance-in 2026 Philly.com named us a Top Workplace for the eleventh year and USA Today named us a USA Top Workplace for the fourth year. We provide excellent benefits and a friendly, team-focused work environment to drive employee engagement.
Manager, IT Governance, Risk & Compliance
The Manager, IT Governance, Risk & Compliance leads The Institutes' governance function for cybersecurity, risk management, compliance, business continuity and disaster recovery (BCDR), third-party risk management (TPRM), and AI governance. This is a governance and assurance orchestration role: the Manager sets standards, reviews and signs off on controls, and brings the organization's resources together to ensure security, AI, and data governance are working as one program. The Manager directs execution through a managed detection and response (MDR) partner, engineering leadership, staff, and platform workflows; hands-on technical security engineering resides with those partners, not with this seat.
This role owns the enterprise Third-Party Risk Management program: vendor risk governance, AI and third-party risk analysis, contractual data governance oversight, and vendor risk analytics and reporting. The Manager may delegate execution of these activities to staff or managed services, but accountability for third-party risk resides fully and solely with this position and may not be delegated.
The Manager governs the security program against the NIST CSF 2.0 framework, holds the MDR relationship and the broader security tool portfolio accountable to defined outcomes, and embeds risk stewardship into the IT delivery model through risk-tiered gates rather than after-the-fact control. The role is the governance owner for enterprise AI use, including agentic development guardrails and the citizen developer program.
Essential Responsibilities
  • Own governance of the enterprise security program aligned to NIST CSF 2.0: set the control baseline, review and sign off on control implementation and maturity assessments, and oversee the remediation roadmap for unimplemented controls, with execution by engineering teams and managed services.
  • Direct and assure daily cybersecurity operations through the MDR relationship: hold the provider to defined service levels; review alert triage, escalation, threat intelligence, and vulnerability management outputs; and sign off on remediation closure.
  • Own incident response governance: ensure security incidents are investigated end to end by the MDR partner and engineering leadership, and sign off on incident documentation, after-action reviews, and improvement actions.
  • Own the Third-Party Risk Management (TPRM) program end to end with full, non-delegable accountability: maintain vendor tier classifications and risk profiles; review and distribute security questionnaires; collect and analyze SOC reports, cyber insurance documentation, and compliance artifacts; track vendor remediation items to closure; and proactively research vendor markets to surface emerging risks and trends.
  • Own AI and third-party risk analysis: conduct AI-focused vendor risk assessments covering model usage, training data sources, and data retention practices; maintain an AI risk scoring methodology; assess model risk exposure (bias, explainability, regulatory considerations); detect and mitigate Shadow AI usage; track vendor data exposure and data-sharing pathways; and operate TPRM/AI governance platform workflows (e.g., OneTrust).
  • Own contractual data governance risk review: evaluate AI/data-related clauses in vendor contracts - data ownership, data residency, model training rights, sub-processor disclosures, and AI indemnification and liability language - in partnership with General Counsel; and provide risk review during vendor onboarding and renewals in partnership with the IT portfolio function.
  • Provide vendor risk analytics and executive reporting: risk dashboards, AI vendor exposure, data risk trends, model risk concentration, and systemic risk patterns across vendor categories.
  • Own governance of the security tool portfolio strategy and consolidation roadmap (endpoint, DSPM, data protection, backup/recovery, SIEM, MDR, and Microsoft security stack), holding sign-off on portfolio decisions with technical evaluation led by engineering leadership.
  • Own BCDR governance: ensure business continuity and disaster recovery plans are maintained, tested, and continuously improved through managed-service and engineering partners, and sign off on test results and recovery validation.
  • Manage audits, reviews, and assessments of information systems; manage cross-functional teams through external audits and maintain compliance documentation and evidence; manage outsourced assessor independence, ensuring assessment and remediation vendors are appropriately separated, and evaluated against program objectives.
  • Develop, implement, and maintain security policies, procedures, and guidelines according to NIST best practices.
  • Own AI governance operations: tool allowlists, coding-standard security requirements, citizen developer guardrails, application admin-consent review, and the risk register for AI-enabled tools.
  • Staff and develop risk review at risk-tiered delivery gates in partnership with engineering leadership, owning gate decisions within the IT delivery model.
  • Ensure delivery of security awareness and training programs to educate employees about information security best practices.
  • Oversee the technical risk management process and prepare cybersecurity and third-party risk reporting for executive leadership and the Board.
  • Perform employee evaluations and reviews for direct reports, documenting as necessary.

Other Responsibilities
  • Stay updated on information security threats, trends, and technologies, and recommend posture improvements.
  • Coordinate and evaluate security testing and penetration testing with third-party vendors.
  • Other duties as assigned.

Required Competencies
  • Risk Management and Governance
  • Control Assurance and Sign-Off
  • Third-Party and AI Risk Analysis
  • Program Orchestration and Cross-Functional Coordination
  • Decision Making
  • Leadership
  • Communication
  • Analytical Thinking
  • Relationship Building
  • Enterprise Perspective
  • Technical Fluency (sufficient to direct managed security services and critically evaluate technical recommendations)
  • Executive-Ready Reporting
  • Employee Development
  • Strive to reflect our five cultural values in all efforts: Put the Customer First, Do What You Say, Work Together, Be Innovative and Do the Right Thing.

Education and Experience
  • Bachelor's degree in information technology, business, risk management, computer science, or equivalent experience.
  • Minimum 8 years of experience in IT governance, risk, compliance, audit, or technical program and analysis leadership across IT infrastructure and software development environments.
  • Minimum 3 years leading a governance, risk, compliance, or assurance function, team, or cross-functional program.
  • Demonstrated experience managing audits and control frameworks (NIST CSF or comparable), including evidence management, control review and sign-off, and coordination of external assessors and security or compliance vendors.
  • Demonstrated experience with third-party risk management, including vendor risk assessment, security questionnaire processes, SOC report analysis, and contract risk review; familiarity with TPRM/governance platforms (e.g., OneTrust) preferred.
  • Working technical fluency across IT infrastructure, cloud environments (AWS and Microsoft stack), and software delivery sufficient to direct managed security services and critically evaluate engineering and vendor recommendations; hands-on security engineering experience and security certifications are not required.
  • Effective hands-on use of LLM-based tools to manage the research and analysis demands of the role.
  • Experience governing AI/ML or agentic technologies preferred; governance and risk certifications (e.g., CRISC, CISA, CGEIT) a plus.

The Best Part? The Benefits!
To enforce the importance of work-life balance, employees enjoy excellent benefits, including:
  • 401(k) plan with company contribution up to 16%
  • Generous time off package that includes paid vacation, personal, sick, and holidays
  • Paid maternity and parental leave
  • Tuition reimbursement
  • Medical, dental, vision, and prescription coverage
  • On our Malvern campus: Free lunch every day when working on campus, onsite fitness center, and a beautiful 1.25-mile walking path!

Equal Opportunity Employer
This employer is required to notify all applicants of their rights pursuant to federal employment laws. For further information, please review the Know Your Rights notice from the Department of Labor.

Apply