Senior Manager, GRC

Role overview

Lead cybersecurity governance, risk, and compliance work across business, IT, cloud, and third-party environments. The role develops the programs and decision frameworks leaders need to understand risk, assign accountability, and apply controls consistently.

Responsibilities

- Establish and operate an enterprise cybersecurity risk program, including risk identification, prioritization, tracking, acceptance, and escalation. - Create executive and board reporting that explains risk in terms of business impact. - Define and govern cybersecurity policies, standards, and control frameworks, and support consistent implementation across environments. - Lead exception management and third-party risk processes, including vendor assessments and tiering. - Coordinate internal and external audits and regulatory engagements with security, IT, legal, compliance, and procurement teams. - Govern security awareness, control testing, vulnerability management, logging, and detection; use incidents and control reviews to guide improvements.

Requirements

- 6–10 or more years of cybersecurity risk management experience. - Leadership experience building and maturing teams, programs, or operating models. - Strong understanding of cybersecurity control frameworks and experience with third-party risk, audit, and compliance work. - Ability to explain technical risk as business impact and guide prioritization and tradeoff decisions. - Experience supporting or leading SOX IT general controls or application control environments. - Excellent communication and stakeholder influence across technical and business teams.

Nice to have

- Experience establishing or improving security awareness and behavior change programs. - Experience managing budgets and resources for governance, risk, and compliance capabilities.