GRC IT Audit & Readiness Specialist

Henry Ford Health partners with millions of people on their health journey, across Michigan and around the world. We offer a full continuum of services from primary and preventative care to complex and specialty care, health insurance, a full suite of home health offerings, virtual care, pharmacy, eye care and other health care retail. With former Ascension southeast Michigan and Flint region locations now part of our team, Henry Ford's care is available in 13 hospitals and hundreds of ambulatory care locations. Based in Detroit, Henry Ford is one of the nation's most respected academic medical centers and is leading the Future of Health: Detroit, a $3 billion investment anchored by a reimagined Henry Ford academic healthcare campus.

Job Description

About the Role:

The Governance, Risk, and Compliance (GRC) Information Technology (IT) Audit and Readiness Specialist facilitates and supports IT audits and compliance assessments for Henry Ford Health and its subsidiaries. Reporting to the IT Security Compliance Manager within Cybersecurity Governance, Risk, and Compliance (CGRC), the Specialist collaborates with Information Privacy and Security Office (IPSO) and IT team members to coordinate SOC 1, SOC 2, General IT Controls, and other assessments. The Specialist applies technical and operational knowledge of information security, auditing, risk management, and applicable legal and regulatory requirements affecting enterprise privacy, security, and risk.

Key Tasks and Duties:

1. Able to develop work with minimal supervision, maintain and report against a work plan, give appropriate updates and status reports, and serve as a point of contact and liaison with internal and external auditors, assessors, vendors, and clients and assist other staff members.
2. Provide Governance Risk and Compliance (GRC) support for third-party audit requests and reporting requests from leadership.
3. Coordinate and facilitate IT audits (internal and external), acting as the central point of contact between auditors and internal stakeholders
4. Collect, review, and organize audit evidence to ensure accuracy, completeness, and timely delivery
5. Partner with control owners to support audit readiness, including guidance on documentation, control execution, and remediation efforts
6. Track audit requests, milestones, and deliverables to ensure deadlines are met and risks are escalated as needed
7. Utilize GRC tools to manage audit workflows, extract evidence, and monitor control performance and compliance status
8. Communicate audit requirements, follow-ups, and status updates clearly to internal teams and external auditors
9. Run reports from the GRC tool to provide third-party audit requests and related reporting.
10. Develop and maintain relationships with key stakeholders across IPSO, IT, and business teams
11. Execute GRC tool system test plans as necessary (ex. For system upgrades, updates, enhancements, new reporting).
12. Participate in continuous learning initiatives specifically related to the GRC system, IT governance, controls, insurance, healthcare, leading security frameworks, and information technology

Qualifications

Education & Experience Required:

• Bachelor’s degree in Accounting, Information Systems, Computer Science or related field preferred, relevant work experience/certification considered.
• Two plus (2+) years of experience in IT risk, IT Controls or IT Audit.
• Demonstrates strong and effective verbal, written, and interpersonal communication skills, with experience in all at the executive level.
• Ability to prioritize and multi-task in a dynamic, fast-paced, and challenging environment.
• Experience with federal and state healthcare information regulations and requirements (e.g., HIPAA) preferred.
• Advanced knowledge of IT systems and functions, process development, change management, and service and implementation lifecycle.
• Knowledge of information security best practices, NIST Cybersecurity Framework , and common risk frameworks.
• Can conform to shifting priorities, demands, and timelines through analytical and problem-solving capabilities.

Certifications:

• CISSP, CISA, CISM preferred.