Remote job
GRC Manager - Technology Risk & Governance
Job details
About this role
Role overview
Lead technology governance and third-party risk activities, helping the organization assess vendors and manage cybersecurity, privacy, AI, and compliance risks. The role works across security, legal, compliance, IT, and business teams, while supporting audit readiness and ongoing security certifications.
Responsibilities
- Manage vendor risk reviews from onboarding through periodic reassessments, tailoring evaluation to the level and type of risk. - Review security and compliance evidence such as audit reports, certifications, penetration test results, continuity plans, and privacy materials. - Coordinate with vendors, auditors, and internal teams to gather evidence and respond to assessment requests and questionnaires. - Document risks, findings, mitigations, and supporting evidence in line with internal procedures. - Prepare risk summaries, dashboards, and governance materials for leadership and committee discussions. - Help maintain security certifications and compliance programs, develop AI risk practices, and improve business continuity planning.
Requirements
- Bachelor’s degree in information systems, cybersecurity, risk management, compliance, or a related field. - Experience in technology risk, governance, compliance, information security, audit, or third-party risk management. - Experience assessing technology vendors, including cloud services, software providers, managed service providers, or AI-enabled products. - Working knowledge of security and compliance frameworks such as ISO 27001, SOC standards, NIST, or CIS Controls. - Experience working with auditors and responding to security, risk, compliance, or vendor questionnaires. - Clear written and verbal communication skills, including the ability to explain risk findings to technical and non-technical audiences.
Nice to have
- Experience with a governance, risk, and compliance platform such as Drata. - Knowledge of AI-related risks, controls, governance practices, and emerging compliance considerations.