Sr. Cyber GRC Specialist

McKesson is an impact-driven, Fortune 10 company that touches virtually every aspect of healthcare. We are known for delivering insights, products, and services that make quality care more accessible and affordable. Here, we focus on the health, happiness, and well-being of you and those we serve – we care.

What you do at McKesson matters. We foster a culture where you can grow, make an impact, and are empowered to bring new ideas. Together, we thrive as we shape the future of health for patients, our communities, and our people. If you want to be part of tomorrow’s health today, we want to hear from you.

About the Role

McKesson is seeking a Senior Cyber GRC Analyst to support and enhance the OneTrust Governance, Risk, and Compliance (GRC) platform while helping advance cybersecurity governance and risk management operations across the enterprise. In this role, you will serve as a key administrator and enablement partner for OneTrust, ensuring the platform effectively supports risk management, compliance, governance, and operational reporting activities. You will work closely with cybersecurity, compliance, risk, and business stakeholders to improve platform adoption, optimize processes, maintain data quality, and drive continuous improvement across GRC workflows.

What You’ll Do

• Administer and support day-to-day operations of the OneTrust GRC platform, including user support, configuration maintenance, and platform governance activities.
• Configure and maintain workflows, forms, questionnaires, notifications, taxonomies, user roles, and reporting capabilities within OneTrust.
• Support and optimize OneTrust modules, including Risk Register, Issues Management, Assessments, Policy Management, Compliance Automation, and Third-Party Risk Management.
• Serve as a liaison between business stakeholders, internal platform teams, and vendor support resources to coordinate issue resolution and platform enhancements.
• Coordinate enhancement requests, user acceptance testing, release reviews, defect management, and stakeholder communications.
• Monitor platform adoption, data quality, reporting accuracy, and operational effectiveness to identify opportunities for improvement.
• Develop dashboards, reports, metrics, and operational summaries that provide visibility into cyber governance, risk, and compliance activities.
• Support data migration, data maintenance, bulk updates, user access administration, and related platform governance processes.
• Create and maintain user guides, job aids, training materials, and operational documentation to support ongoing platform adoption and effectiveness.
• Identify and implement automation opportunities that improve platform efficiency, streamline workflows, and enhance the user experience.
• Support cybersecurity governance forums and operational reviews through meeting planning, status reporting, action tracking, and follow-up coordination.
• Contribute to cyber GRC reporting, metrics analysis, and governance activities that support leadership decision-making and operational transparency.

Basic Requirements

• 7+ years of relevant professional experience supporting GRC platforms, enterprise risk management, compliance, audit, cybersecurity governance, or related operational programs.
• Hands-on experience administering, configuring, or supporting the OneTrust platform.
• Experience supporting OneTrust modules such as Risk Register, Issues Management, Assessments, Policy Management, Third-Party Risk Management (TPRM), or Compliance Automation.
• Experience developing dashboards, metrics, reports, and operational summaries for stakeholders and leadership.
• Experience supporting workflow configuration, questionnaires, forms, notifications, user roles, and data quality activities.
• Strong analytical, troubleshooting, process improvement, and stakeholder support skills.
• Bachelor's degree in Cybersecurity, Information Security, Information Systems, Computer Science, Business, or a related field, or equivalent experience.

Preferred Skills/Experience

• OneTrust Professional Certification(s).
• Experience supporting enterprise GRC platforms or integrated risk management programs in addition to OneTrust.
• Experience supporting cybersecurity governance operations, reporting programs, or stakeholder coordination activities.
• Familiarity with cybersecurity and risk frameworks such as NIST CSF, NIST RMF, ISO 27001, HITRUST, or similar standards.
• Experience supporting audit, compliance, regulatory, or assurance-related activities.
• Relevant certifications such as CRISC, CGRC, CISA, CISSP, CISM, or comparable cybersecurity and risk management credentials.
• Strong communication, collaboration, organizational, and continuous improvement skills.
• Ability to translate business needs into scalable GRC platform solutions and operational processes.

Travel / Work Environment / Physical Requirements

Work model, office expectations, and travel requirements to be confirmed based on team and business needs.

Role may require working at a computer for extended periods and participating in virtual or in-person meetings.

At McKesson, we care about the well-being of the patients and communities we serve, and that starts with caring for our people. That’s why we have a Total Rewards package that includes comprehensive benefits to support physical, mental, and financial well-being. Our Total Rewards offerings serve the different needs of our diverse employee population and ensure they are the healthiest versions of themselves.

As part of Total Rewards, we are proud to offer a competitive compensation package at McKesson. This is determined by several factors, including performance, experience and skills, equity, regular job market evaluations, and geographical markets. The pay range shown below is aligned with McKesson's pay philosophy, and pay will always be compliant with any applicable regulations.  In addition to base pay, other compensation, such as an annual bonus or long-term incentive opportunities may be offered. 

Our Base Pay Range for this position

McKesson has become aware of online recruiting-related scams in which individuals who are not affiliated with or authorized by McKesson are using McKesson’s (or affiliated entities, like CoverMyMeds or RxCrossroads) name in fraudulent emails, job postings or social media messages. In light of these scams, please bear the following in mind:

McKesson Talent Advisors will never solicit money or credit card information in connection with a McKesson job application.

McKesson Talent Advisors do not communicate with candidates via online chatrooms or using email accounts such as Gmail or Hotmail. Note that McKesson does rely on a virtual assistant (Gia) for certain recruiting-related communications with candidates.

McKesson job postings are posted on our career site: careers.mckesson.com.