# Hiring signals

Controlspan Research Desk · Last updated 28 October 2026

# What is the main finding?

**The clearest hiring signal is investment in the people who own, improve and operate GRC platforms—not necessarily investment in replacement software.** Guardian’s risk-technology leadership vacancy combines strategy with ongoing operations; Optum’s product-owner role focuses on delivery and platform health; FNBO’s AI integration role includes validation and continuing administration. Our interpretation is that buyers should budget for a continuing operating capability, not just an implementation project. These postings do not disclose approved software expenditure. ([guardianlife.wd5.myworkdayjobs.com](https://guardianlife.wd5.myworkdayjobs.com/Guardian-Life-Careers/job/New-York/ServiceNow-Risk-Platform-Manager_R000110078?utm_source=openai))

For a CRO, CISO or GRC programme lead, the useful question is therefore not simply, “Who is hiring GRC analysts?” It is:

> **Which responsibilities are organisations explicitly assigning to people—and which of those responsibilities are missing from our own GRC business case?**

This research separates three signals:

- **Buyer-side platform ownership:** roadmap, configuration, releases, integrations and vendor management.
- **Buyer-side risk operations:** assessments, control testing, evidence interpretation and remediation.
- **Supplier-side capacity:** implementation delivery and technical selling.

The employer evidence below supports these distinctions. The budget interpretations and proposed evaluation methods are the desk’s analysis, not employer disclosures.

---

# How was the evidence assessed?

The core sample contains **13 distinct advertised roles: ten at organisations using GRC capabilities and three at implementation or software suppliers**. It is a purposive sample selected for explicit platform responsibilities, useful compensation disclosures and relevance to enterprise buyers. It is **not a vacancy census, salary survey or measure of hiring growth**.

Research prioritised recent material and followed job-board discoveries back to employer career pages where possible. Undated postings were retained where their responsibilities were particularly informative. Large financial institutions and technology businesses are overrepresented; their staffing patterns should not be transplanted unchanged into a 500-person regulated organisation.

### What do the evidence-status labels mean?

| Label | Meaning | How to use it |
|---|---|---|
| **Page available** | The specific employer job description rendered during review | Evidence of advertised responsibilities and pay; not confirmation that recruitment remains active |
| **Indexed primary** | Employer-hosted text was available through search, but direct retrieval did not expose the full description | Useful role evidence; current vacancy status remains unconfirmed |
| **Historical** | A closing date has passed or the page reports removal or filling | Evidence of an advertised staffing requirement, not a current opening |
| **Redirected** | Indexed employer text exists, but the job URL now redirects to general careers | Do not count as a confirmed active vacancy |
| **Secondary archive** | A job board preserves employer-attributed text | Lower-confidence evidence; distinguish employer wording from board-generated summaries |

**A concrete warning about freshness:** Cboe’s indexed description remained discoverable, but its career page reported that the position had been filled. KeyBank’s posting carried an expiration date of **25 June 2026**. Neither should be presented as an open October vacancy. ([careers.cboe.com](https://careers.cboe.com/us/en/job/R-4725/GRC-Platform-Principal?utm_source=openai))

Compensation below is annual USD unless stated otherwise. These are **individual advertised ranges**, not statistically representative “typical salaries”. Base pay, unspecified salary ranges and on-target earnings are kept separate.

---

# Which enterprise GRC platform roles are organisations hiring for?

### Who owns the platform, its configuration and its technical roadmap?

| Employer and advertised role | Location and evidence status | Published compensation | Responsibilities relevant to buyers | Desk interpretation |
|---|---|---:|---|---|
| **Cboe — GRC Platform Principal** | Chicago; four office days weekly. **Historical:** employer page reports filled | **$163,625–$211,750 base**; possible incentives and equity | Platform roadmap, configuration, user experience, access controls, releases, integrations and vendor relationships | A senior operating owner, not merely an implementation coordinator. Does not prove replacement intent. ([careers.cboe.com](https://careers.cboe.com/us/en/job/R-4725/GRC-Platform-Principal?utm_source=openai)) |
| **Guardian — ServiceNow IRM Manager** | New York, Bethlehem, Holmdel or Stamford; three office days weekly. **Indexed primary**, R000110078 | **$152,290–$250,195 base**, stated for the primary location; possible incentives | Multi-year risk-technology strategy; IRM, business continuity and third-party risk; operations, upgrades, technical debt and mixed internal/external delivery teams | Evidence of a continuing platform-management remit across several workflows. ([guardianlife.wd5.myworkdayjobs.com](https://guardianlife.wd5.myworkdayjobs.com/Guardian-Life-Careers/job/New-York/ServiceNow-Risk-Platform-Manager_R000110078?utm_source=openai)) |
| **Optum / UnitedHealth Group — Technical Product Owner, Enterprise GRC Platforms** | US remote; Houston listed. **Page available**, requisition 2350071; posted **29 September 2026** | **$72,800–$130,000 salary** | Backlogs, acceptance criteria, release delivery and production stability across Archer, Aravo and Compliance Hub | Product ownership can cover a portfolio rather than a single consolidated platform. ([careers.unitedhealthgroup.com](https://careers.unitedhealthgroup.com/job/houston/technical-product-owner-enterprise-grc-platforms/34088/94022373232?utm_source=openai)) |
| **Huntington — Senior GRC Software Developer** | Multiple US corporate offices; office-based. **Page available**, R0074582 | **$57,000–$113,000 base**; incentive eligibility | Develop, test and support GRC applications; implement new and existing platforms; preferred experience includes Archer, OpenPages, ProcessUnity and ServiceNow IRM | Engineering and production support belong in the operating model. The list of preferred products does not prove all are deployed. ([huntington-careers.com](https://huntington-careers.com/search/jobdetails/senior-grc-software-developer/66c9f7d5-aa1b-43ad-9ec4-98fc5b12bd34)) |
| **KeyBank — Archer GRC BA** | Brooklyn, Ohio, or US remote listed. **Historical:** expired **25 June 2026**, R-39119 | **$96,000–$181,000 base**; incentive eligibility | Requirements, process diagrams, role definitions, testing and ongoing application enhancement | Business analysis and acceptance testing are distinct delivery responsibilities—not work that should disappear into a generic administrator allowance. ([keybank.wd5.myworkdayjobs.com](https://keybank.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/Archer-GRC-BA_R-39119?utm_source=openai)) |
| **FNBO — Sr. Analyst, AI Systems Integration** | Omaha; three office days weekly. **Indexed primary**, R-20261209 | **$81,662–$134,741 base** | Maintain an AI-enabled legal, risk and compliance knowledgebase; refine prompts and workflows; validate outputs; support Archer-related AI capabilities | AI deployment creates configuration, evaluation and maintenance work as well as potential automation benefits. ([firstnational.wd12.myworkdayjobs.com](https://firstnational.wd12.myworkdayjobs.com/fnbocareers/job/Sr-Analyst--AI-Systems-Integration_R-20261209?utm_source=openai)) |

**Buyer implication:** distinguish ownership from execution. Cboe explicitly described a platform-ownership role that did not require hands-on software development, while Huntington sought development and production-support capability. Our recommendation is to decide who sets priorities, who builds changes and who accepts them before deciding whether those duties require separate hires. ([careers.cboe.com](https://careers.cboe.com/us/en/job/R-4725/GRC-Platform-Principal?utm_source=openai))

### Who operates assessments, controls and evidence workflows?

| Employer and advertised role | Location and evidence status | Published compensation | Responsibilities relevant to buyers | Desk interpretation |
|---|---|---:|---|---|
| **Stripe — Security GRC Program Manager, Third Party Risk** | US remote. **Page available**, job 8241288 | **$131,200–$196,800 base**; other rewards may apply | Supplier assessments, assurance-document review, remediation, risk acceptance and operational reporting; records decisions in Zip and Aravo | A strong signal of assessment capacity and process improvement, but weak evidence of a new platform purchase. ([stripe.com](https://stripe.com/careers/listing/security-grc-program-manager-third-party-risk/8241288?gh_src=General+Catalyst+job+board&utm_source=openai)) |
| **Pendo — Sr. GRC Engineer** | Raleigh office. **Page available**, job 8822007002 | **$133,400–$160,000 advertised annual range** | Compliance-programme ownership, AI-assisted evidence and testing workflows, risk prioritisation and incident-response leadership | “GRC engineer” can describe a broad security role; do not assume it means a dedicated connector developer. ([job-boards.greenhouse.io](https://job-boards.greenhouse.io/pendo/jobs/8822007002)) |
| **Headway — Senior Governance, Risk, Compliance Analyst** | San Francisco, New York or Seattle; hybrid. **Indexed primary** | **$161,600–$202,000 base**; possible equity | Establish the GRC function; use modern tooling and evidence automation; experience with platforms such as Vanta, Drata or OneTrust | A function-building mandate is a stronger readiness signal than routine administration, but does not establish a selected vendor. ([jobs.ashbyhq.com](https://jobs.ashbyhq.com/headway/9e503e4c-6fea-4401-8458-c20f4d4f1e5e?utm_source=openai)) |
| **HUB International — Senior Analyst, Internal Controls & SOX** | Chicago. **Secondary archive:** removed **24 July 2026** | **$90,000–$110,000 salary** | IT controls, SOX scoping and testing, remediation and Workiva system administration | Platform administration may be embedded in a controls role rather than advertised as separate headcount. ([builtinchicago.org](https://www.builtinchicago.org/job/senior-analyst-internal-controls-sox/10138493?utm_source=openai)) |

The HUB example is particularly useful for finance and audit sponsors: an analyst title can conceal an additional system-administration responsibility. **Our recommendation is to make that allocation explicit**, with time for access reviews, configuration, support and release testing rather than treating administration as incidental work. ([builtinchicago.org](https://www.builtinchicago.org/job/senior-analyst-internal-controls-sox/10138493))

---

# What does supplier hiring reveal—and what does it not reveal?

**Supplier vacancies show the capabilities suppliers want to build or maintain. They do not establish signed customer demand, delivery availability or market-wide growth.** Treat them as prompts for supplier due diligence, not as substitutes for customer evidence.

| Supplier and role | Evidence status | Published compensation | Advertised responsibilities | Buyer-side reading |
|---|---|---:|---|---|
| **EY — Risk Consulting, Risk Technology, GRC/IRM Platforms Manager** | **Page available**, requisition 1719982; dated **18 October 2026**; multiple US locations | **$124,900–$229,100 base** general US range; **$150,000–$260,400** for NYC metro, Washington State and California excluding Sacramento | ServiceNow IRM architecture, implementation, integrations, project leadership and business development | Ask which named delivery staff are committed to your engagement; a recruitment advertisement is not reserved capacity. ([careers.ey.com](https://careers.ey.com/ey/job/New-York-Risk-Consulting-Risk-Technology-GRCIRM-Platforms-Manager-NY-10001-8604/1407621533/?utm_source=openai)) |
| **LogicGate — Implementation Services Manager** | Chicago or Bellevue; hybrid. **Indexed primary; job URL redirected** during review | **$95,000–$115,000 base**, plus variable compensation, equity and benefits | Customer onboarding, concurrent implementation projects, workflow and relational-data configuration, migration support and stakeholder management | Low-code or no-code configuration still needs delivery and data skills. Confirm the staffing model for the quoted scope. ([job-boards.greenhouse.io](https://job-boards.greenhouse.io/logicgate/jobs/4700060005?gh_src=425fc2345us&utm_source=openai)) |
| **Workiva — Senior Solution Consultant, GRC, Public Sector** | US remote. **Indexed primary**, R12182; pay corroborated by a job-board copy | **$156,000–$255,000 OTE**, not base salary; commission eligibility and equity separately described | Discovery, demonstrations, RFP support, proofs of concept and technical qualification | This is commercial capacity. Do not count a presales consultant as the implementation team or interpret the vacancy as a customer purchase. ([workiva.wd503.myworkdayjobs.com](https://workiva.wd503.myworkdayjobs.com/careers/job/usa---remote/senior-solution-consultant---governance--risk--and-compliance_r12182?utm_source=openai)) |

The compensation distinction matters. An OTE range is not comparable with an internal administrator’s base salary. Equally, an implementation employee’s salary is not a customer-facing consulting rate: obtain the supplier’s actual pricing, staffing assumptions and statement of work rather than deriving a rate from recruitment disclosures.

---

# Which hiring signals indicate selection, implementation, expansion or ordinary operations?

**Read the verbs and deliverables, not just the title or named product.** The following is a proposed desk classification method, not a validated prediction model.

| Wording to look for | Provisional classification | What to confirm before drawing a budget conclusion |
|---|---|---|
| Select, evaluate, run an RFP, lead vendor due diligence | **Selection readiness** | Is software procurement authorised? Who owns the decision and funding? |
| Migrate, map source data, reconcile, cut over, retire legacy tooling | **Implementation or replacement** | Is the target selected? Are migration and dual-running funded? |
| Extend modules, introduce workflows, onboard entities | **Expansion** | Does the work use existing entitlements or require additional licences? |
| Own roadmap, release management, upgrades, administration | **Continuing platform operations** | Is this new headcount, a replacement hire or insourcing? |
| Assess suppliers, test controls, collect evidence, close findings | **Risk or assurance operations** | Is the bottleneck staffing, process design, integration or software? |
| Build demonstrations, support account plans, achieve technical wins | **Supplier commercial investment** | No buyer budget should be inferred without separate evidence |

### What does this sample support most strongly?

**Continuing operation and improvement are better evidenced than platform replacement.** Guardian’s remit includes lifecycle management and technical debt; Optum’s includes stability and backlog health. Our reading is that these roles fit an ongoing product model. Neither posting establishes a decision to abandon an incumbent. ([guardianlife.wd5.myworkdayjobs.com](https://guardianlife.wd5.myworkdayjobs.com/Guardian-Life-Careers/job/New-York/ServiceNow-Risk-Platform-Manager_R000110078?utm_source=openai))

**Named tools need contextual interpretation.** Stripe describes recording assessments in named programme systems, whereas Huntington lists several platforms as preferred candidate experience. The former is stronger evidence of an operating workflow; the latter is a skills requirement and should not be converted into an installed-base claim. ([stripe.com](https://stripe.com/careers/listing/security-grc-program-manager-third-party-risk/8241288?gh_src=General+Catalyst+job+board&utm_source=openai))

**Building a GRC function is not identical to buying enterprise GRC software.** Headway’s wording supports a function-building interpretation. It does not disclose a procurement timetable, approved subscription budget or requirement for a broad enterprise-risk suite. ([jobs.ashbyhq.com](https://jobs.ashbyhq.com/headway/9e503e4c-6fea-4401-8458-c20f4d4f1e5e?utm_source=openai))

### What additional evidence makes a hiring signal useful?

Before using a vacancy to inform your own roadmap—or treating another organisation as a reference peer—seek:

- A named business sponsor and accountable platform owner.
- An explanation of whether the role is new, backfill, insourcing or temporary project capacity.
- The first workflow and intended users.
- The existing platform and its renewal decision date.
- An implementation milestone or operational service target.
- Separate approval routes for employees, contractors, services and software.

**Do not infer an employer’s confidential budget from its advertised salary.** The salary identifies a potential labour commitment; it does not establish the software or services allocation.

---

# Is AI changing the GRC staffing requirement?

**The sampled roles support a change in work content, not a conclusion that AI has eliminated the need for GRC staff.** FNBO explicitly assigns output validation, prompt refinement, configuration and ongoing optimisation. Pendo combines AI-assisted workflows with compliance ownership and security judgement. These are advertised responsibilities, not measured productivity outcomes. ([firstnational.wd12.myworkdayjobs.com](https://firstnational.wd12.myworkdayjobs.com/fnbocareers/job/Sr-Analyst--AI-Systems-Integration_R-20261209?utm_source=openai))

For a buyer evaluating AI-enabled GRC, this distinction suggests three separate responsibilities:

| Responsibility to assign | Proposed evidence of competence | Procurement consequence |
|---|---|---|
| **Operate the AI-enabled workflow** | Document inputs, configuration, permitted uses and escalation paths | Require an administrator handover, not just a feature demonstration |
| **Evaluate its outputs** | Test unsupported mappings, missing evidence and inconsistent answers against a controlled dataset | Budget review and regression-testing time |
| **Approve consequential decisions** | Establish who can accept risk, approve exceptions or close findings | Keep decision authority explicit rather than hidden inside automation |

NIST’s AI RMF Core addresses documented responsibilities, personnel training and executive accountability. Its framework is voluntary; NIST also states that AI RMF 1.0 is being revised. These are useful governance reference points, not proof that a specific AI-GRC product or staffing model satisfies every applicable obligation. ([airc.nist.gov](https://airc.nist.gov/airmf-resources/airmf/5-sec-core/?utm_source=openai))

Practitioner discussion is directionally consistent but weaker evidence. The April 2026 TPRM Podcast episode featuring Ayoub Fandi discusses systems thinking, stakeholder alignment and moving beyond simply automating existing compliance work. Its published episode notes are useful qualitative context; they are not a hiring survey, and the programme identifies a commercial sponsor. ([tprmpodcast.com](https://tprmpodcast.com/episodes/grc-wrong-problem?utm_source=openai))

**Buyer recommendation:** treat projected AI labour savings as a hypothesis to test. Compare the time needed to prepare, review, correct, approve and maintain the workflow—not merely the time taken to generate an answer.

---

# Do regulatory pressures mean GRC budgets must be growing?

**No market-wide budget-growth conclusion can be drawn from this sample.** It identifies responsibilities employers advertised, not net hiring, total expenditure or the reasons each vacancy exists.

There is also relevant counterevidence to an uncomplicated growth narrative. Compliance Week’s May 2026 coverage of Maurice Crescenzi’s remarks reported concerns about flat or shrinking budgets. That is practitioner context rather than a representative US enterprise GRC budget measurement, but it is a reason not to equate increasing responsibilities with increasing resources. ([complianceweek.com](https://www.complianceweek.com/top-stories/maurice-l-crescenzi-jr-new-president-of-eci-compliance-week-calls-on-compliance-leaders-to-close-the-gap-between-risk-and-readiness/?utm_source=openai))

For banks, the 2023 interagency third-party guidance discusses sufficient staffing, expertise, authority and accountability for ongoing monitoring. However, on **11 September 2026**, agencies proposed replacement guidance; the Federal Reserve’s proposal page lists comments due **16 November 2026**. As of this research date, that proposal should not be represented as an already-finalised replacement or a new software-purchase mandate. ([federalreserve.gov](https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm?utm_source=openai))

**Our procurement interpretation:** justify the staffing and platform scope against your actual workload, risk profile and applicable requirements. Do not use a regulatory headline as a substitute for a role-by-role operating plan.

---

# How should buyers use these salary ranges in a three-year GRC total cost of ownership model?

**Use the postings as role-design comparators, not as a blended market average.** The sample spans operational analysts, product owners, senior technology leaders and supplier sales staff. For example, Optum asks for a product-delivery profile with two or more years of relevant experience, while Guardian asks for ten or more years of technology leadership. Their pay ranges should not be averaged into one “GRC platform owner salary”. ([careers.unitedhealthgroup.com](https://careers.unitedhealthgroup.com/job/houston/technical-product-owner-enterprise-grc-platforms/34088/94022373232?utm_source=openai))

For an enterprise GRC software pricing or implementation-cost comparison, use a separate labour schedule:

`Annual attributable labour = Σ(annual base pay × employer-cost multiplier × allocated FTE)`

Then add separately:

- Incentive compensation and other employment costs not included in the multiplier.
- Recruitment, training and any temporary cover.
- External implementation and managed-service charges.
- Internal migration, testing and control-owner participation.
- Software, environments, integrations and support.
- Dual-running and an optional exit scenario.

These are proposed modelling categories, not measured cost proportions. Finance should determine the employer-cost multiplier and treatment of equity, overhead and existing staff allocations.

### What would an illustrative labour model look like?

**The following is entirely synthetic. It is not a recommended team size, market salary benchmark or quotation.** It assumes flat pay, a 30% employer-cost loading and the same allocations for three years.

| Illustrative responsibility | Assumed full-time base salary | Allocation | Annual loaded allocation |
|---|---:|---:|---:|
| Platform owner | $150,000 | 1.00 FTE | $195,000 |
| Shared integration engineer | $140,000 | 0.50 FTE | $91,000 |
| Shared business analyst | $120,000 | 0.25 FTE | $39,000 |
| **Total** | | **1.75 FTE** | **$325,000** |

**Three-year attributable labour: $975,000**, before software, implementation partners, migration peaks or other excluded expenditure.

This calculation is intended to expose an omitted cost category—not to suggest that every deployment needs this staffing level. It also does not imply $975,000 of incremental cash expenditure if existing employees provide the capacity. Show **new cash commitments** and **allocated internal capacity** separately.

### What should not be done with these figures?

- Do not treat the bottom of every advertised range as an achievable hiring price.
- Do not apply a senior enterprise-leadership range to a narrowly scoped administrator.
- Do not convert supplier OTE into a buyer-side base-pay benchmark.
- Do not double-count a shared engineer in both central IT and the GRC programme.
- Do not assume an existing employee has spare capacity because no new position is requested.
- Do not deduct hypothetical automation savings before measuring the replacement review workload.

---

# Which responsibilities should be staffed before signing a platform contract?

**Assign the responsibilities before deciding how many people to hire.** The following is a proposed operating model for selection and implementation planning, not an observed industry staffing ratio.

| Stage | Responsibility that needs an owner | Deliverable to require |
|---|---|---|
| **Before shortlist** | Business-process and risk ownership | Agreed first workflow, decision rights, taxonomy and acceptance objectives |
| **Before contract** | Platform ownership and architecture | Operating model, access design, integration ownership and three-year resource plan |
| **Before migration** | Data stewardship and business analysis | Source inventory, mappings, exception backlog and reconciliation criteria |
| **Before go-live** | Configuration, testing and adoption | Tested workflows, user guidance, support routes and accepted migration results |
| **After go-live** | Administration and engineering support | Release calendar, monitored integrations, backlog and recovery procedures |
| **Throughout** | Independent review and accountable risk decisions | Appropriate separation between operation, approval and assurance |

For buyers asking **how to move from spreadsheets to GRC software**, the first staffing decision should be who can resolve ambiguous records and ownership—not simply who can import a file.

For buyers asking **how much GRC implementation costs**, insist that the statement of work identifies what the customer must provide. A migration price is not a complete resource plan if cleansing, reconciliation, testing and business approvals remain unallocated.

For buyers comparing **ServiceNow IRM, Archer and IBM OpenPages**, use the same role-based test: can the proposed internal team operate the configured workflows and integrations? This research does not establish that one platform requires fewer staff than another.

---

# How can buyers test whether a candidate or implementation team can do the work?

**Use work samples matched to the responsibility, rather than relying on a broad GRC title.** These are proposed evaluation exercises using synthetic or redacted material.

| Role | Practical exercise | What a convincing response should show |
|---|---|---|
| **GRC platform owner** | Prioritise a backlog containing an access defect, new regulatory mapping, overdue integration fix and dashboard request | Clear trade-offs, decision rights and release acceptance criteria |
| **Business analyst** | Convert a disputed-risk-score scenario into requirements | Actors, state changes, evidence, permissions, exceptions and testable outcomes |
| **Administrator / configurator** | Change an approval route without exposing restricted evidence | Supported configuration, impact analysis, test steps and rollback plan |
| **Integration engineer** | Diagnose duplicate or missing evidence after a failed synchronisation | Reconciliation, failure handling, monitoring and an accountable support route |
| **Controls / audit specialist** | Explain when an existing evidence item can be reused | Scope, period, provenance, access and review requirements |
| **AI evaluation owner** | Assess plausible but unsupported control mappings | Reference answers, error categories, escalation and repeatable regression tests |

EY’s advertised implementation-manager role asks for ServiceNow certifications, implementation experience and integration capability. That supports checking credentials where relevant—but our recommendation is to require demonstrated delivery judgement as well as certification. ([careers.ey.com](https://careers.ey.com/ey/job/New-York-Risk-Consulting-Risk-Technology-GRCIRM-Platforms-Manager-NY-10001-8604/1407621533/?utm_source=openai))

---

# What should procurement ask implementation and managed-service suppliers?

Use hiring evidence to sharpen these questions, rather than to accuse a supplier of being understaffed:

1. **Which named people will deliver our project?** Distinguish presales, architecture, configuration, migration and support.
2. **Which commitments are confirmed?** Ask about start dates, substitution rights and competing allocations.
3. **Which work remains ours?** Make data cleansing, control decisions, evidence review and acceptance explicit.
4. **Who owns integrations after go-live?** Include monitoring, fixes and changes in source systems.
5. **What is the administrator handover test?** Require the buyer’s team to perform representative changes.
6. **What capacity is included after launch?** Define hours, service scope, exclusions and change pricing.
7. **Who evaluates AI changes?** Include new model versions, prompt changes and permission-sensitive use cases.
8. **What leaves with us at exit?** Specify configuration documentation, data relationships, attachments, history and runbooks for validation.

The distinction between sales and delivery is visible in the sample: Workiva’s role is explicitly presales, while LogicGate’s is implementation-focused. Our recommendation is to retain the useful presales evidence but contract against named delivery responsibilities and accepted outputs. ([workiva.wd503.myworkdayjobs.com](https://workiva.wd503.myworkdayjobs.com/careers/job/usa---remote/senior-solution-consultant---governance--risk--and-compliance_r12182?utm_source=openai))

---

# How should this desk monitor hiring signals without overstating demand?

**Track changes to distinct requisitions, not search-result counts.** The proposed monitoring record should contain:

- Employer and whether the role serves internal operations, client delivery or sales.
- Requisition ID, exact title and source URL.
- First observed date, employer publication date where available, and last checked date.
- Current retrieval status and any explicit closing or removal date.
- Location, working arrangement and employment type.
- Compensation basis: base, salary, OTE, hourly pay or undisclosed.
- Platform names and whether they describe current systems, preferred experience or future selection.
- Explicit implementation, migration, operation and AI-evaluation duties.
- New headcount versus backfill, recorded as **unknown** unless confirmed.
- Separate analyst inference, confidence and next verification question.

Do not count multi-location copies as separate vacancies without distinct requisitions. Do not interpret a refreshed date as proof of new headcount. Where possible, confirm the actual operating-model change with the hiring organisation before drawing a demand conclusion.

### What should a buyer do next?

Use this research to produce three practical artefacts:

1. **After-the-Consultants GRC Operating Plan:** assign every continuing responsibility and identify unallocated work.
2. **Three-Year GRC Total Cost of Ownership model:** distinguish new hires, shared capacity, services and software.
3. **Enterprise GRC Demonstration and Acceptance Pack:** test administrative changes, failed integrations, restricted evidence and handover.

**Bottom line:** choose a platform against the operating team you can fund and sustain. Treat hiring advertisements as evidence of work that needs doing—not proof that budgets are expanding, a vendor is winning, or another platform purchase is imminent.

---

# Sources

Employer postings are the primary evidence except where explicitly labelled. URLs are provided for auditability; job pages may subsequently close or change.

### Buyer-side role evidence

1. Cboe — GRC Platform Principal; indexed role and live filled-status page: `https://careers.cboe.com/us/en/job/R-4725/GRC-Platform-Principal`
2. Guardian — ServiceNow IRM Manager, R000110078: `https://guardianlife.wd5.myworkdayjobs.com/Guardian-Life-Careers/job/New-York/ServiceNow-Risk-Platform-Manager_R000110078`
3. UnitedHealth Group / Optum — Technical Product Owner, Enterprise GRC Platforms: `https://careers.unitedhealthgroup.com/job/houston/technical-product-owner-enterprise-grc-platforms/34088/94022373232`
4. Huntington — Senior GRC Software Developer, R0074582: `https://huntington-careers.com/search/jobdetails/senior-grc-software-developer/66c9f7d5-aa1b-43ad-9ec4-98fc5b12bd34`
5. KeyBank — Archer GRC BA, R-39119: `https://keybank.wd5.myworkdayjobs.com/en-US/External_Career_Site/job/Archer-GRC-BA_R-39119`
6. FNBO — Sr. Analyst, AI Systems Integration: `https://firstnational.wd12.myworkdayjobs.com/fnbocareers/job/Sr-Analyst--AI-Systems-Integration_R-20261209`
7. Stripe — Security GRC Program Manager, Third Party Risk: `https://stripe.com/careers/listing/security-grc-program-manager-third-party-risk/8241288`
8. Pendo — Sr. GRC Engineer: `https://job-boards.greenhouse.io/pendo/jobs/8822007002`
9. FirstMark portfolio job board — Pendo role and compensation corroboration: `https://jobs.firstmark.com/companies/pendo/jobs/94730972-sr-grc-engineer`
10. Headway — Senior GRC Analyst: `https://jobs.ashbyhq.com/headway/9e503e4c-6fea-4401-8458-c20f4d4f1e5e`
11. Built In Chicago — archived HUB International role: `https://www.builtinchicago.org/job/senior-analyst-internal-controls-sox/10138493`

### Supplier-side role evidence

12. EY — Risk Technology, GRC/IRM Platforms Manager: `https://careers.ey.com/ey/job/New-York-Risk-Consulting-Risk-Technology-GRCIRM-Platforms-Manager-NY-10001-8604/1407621533/`
13. LogicGate — Implementation Services Manager; indexed posting, subsequently redirecting: `https://job-boards.greenhouse.io/logicgate/jobs/4700060005`
14. Workiva — Senior Solution Consultant, GRC, Public Sector: `https://workiva.wd503.myworkdayjobs.com/careers/job/usa---remote/senior-solution-consultant---governance--risk--and-compliance_r12182`
15. FlexJobs — Workiva posting and OTE corroboration: `https://www.flexjobs.com/gjw/workiva/senior-solution-consultant-governance-risk-and-compliance-public-sector/publicjobs?id=bc7f03c0-9a2c-46d4-bed6-67dad62763a2`

### Official and contextual evidence

16. NIST — AI RMF Core: `https://airc.nist.gov/airmf-resources/airmf/5-sec-core/`
17. NIST — AI Risk Management Framework and revision status: `https://www.nist.gov/itl/ai-risk-management-framework`
18. Federal Reserve — 2023 interagency third-party relationship guidance: `https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm`
19. Federal Reserve — proposed replacement guidance, 11 September 2026: `https://www.federalreserve.gov/newsevents/pressreleases/bcreg20260911a.htm`
20. Federal Reserve — proposal details and comment deadline: `https://www.federalreserve.gov/apps/proposals/FR-2026-0031-01/details`
21. Compliance Week — Maurice Crescenzi on the gap between risk and readiness: `https://www.complianceweek.com/top-stories/maurice-l-crescenzi-jr-new-president-of-eci-compliance-week-calls-on-compliance-leaders-to-close-the-gap-between-risk-and-readiness/`
22. TPRM Podcast — published episode notes and linked video, 20 April 2026: `https://tprmpodcast.com/episodes/grc-wrong-problem`