GRC, Vulnerability Management Analyst

About Acrisure 

A global fintech leader, Acrisure empowers millions of ambitious businesses and individuals with the right solutions to grow boldly forward. By bringing cutting-edge technology and top-tier human support together, we connect clients with customized solutions across insurance, reinsurance, payroll, benefits, cybersecurity, mortgage services — and more. 

In the last twelve years, Acrisure has grown in revenue from $38 million to nearly $5 billion, with over 19,000 colleagues in more than 20 countries. Acrisure was built on entrepreneurial spirit. Prioritizing leadership, accountability, and collaboration, we equip our teams to work at the highest levels possible. 

Job Summary 

The Cybersecurity Vulnerability Governance Analyst is responsible for governing and overseeing the organization's Vulnerability Management Program from a risk, compliance, and accountability perspective. This role serves as the bridge between Cybersecurity, IT Operations, Infrastructure, Cloud, Application Development, and business stakeholders to ensure vulnerabilities are appropriately evaluated, assigned, remediated, accepted, or escalated according to established policies and risk tolerance. 

This position does not perform engineering work and instead, the analyst is responsible for vulnerability governance, risk reporting, metrics, exception management, policy adherence, and executive-level visibility into the organization's vulnerability posture. 

Success in this role means establishing strong accountability across the organization for vulnerability remediation while providing clear visibility into cyber risk, remediation performance, and program effectiveness. The analyst enables informed risk decisions, supports regulatory compliance, and helps reduce organizational exposure by ensuring vulnerabilities are managed in accordance with enterprise risk expectations and security governance standards. 

Responsibilities:

Essential Duties and Responsibilities - Vulnerability Governance 

• Govern the enterprise Vulnerability Management Program to ensure alignment with cybersecurity policies, standards, and risk management requirements. 
• Track vulnerabilities through their lifecycle from identification through remediation, mitigation, risk acceptance, or closure. 
• Monitor vulnerability remediation performance against established service level objectives and risk-based remediation timelines. 
• Facilitate regular vulnerability review meetings with infrastructure, cloud, endpoint, application, and business stakeholders. 
• Coordinate remediation activities by validating ownership, accountability, and risk prioritization across responsible teams. 

Risk Management and Exception Governance 

• Review, document, and manage vulnerability exception requests, risk acceptances, and compensating control assessments. 
• Evaluate business and technical justifications for remediation extensions and risk acceptance decisions. 
• Ensure vulnerability risks are assessed and managed in accordance with enterprise risk tolerance and governance standards. 
• Escalate overdue vulnerabilities, repeat offenders, and unresolved risk issues to appropriate leadership and governance forums. 
• Partner with Enterprise Risk Management and Compliance teams to maintain consistent risk management practices. 

Reporting, Metrics, and Compliance Oversight 

• Develop and maintain