Director, Governance, Risk & Compliance

Overview

Key Responsibilities

• Risk Management: Lead organization-wide risk analysis, maintaining a risk register with documented remediation and mitigation plans. Serve as the primary advisor on information security risks to security management and business unit leads.
• Compliance & Audit: Establish and own the strategy for managing security audits, compliance checks, and external assessments — including GDPR, SOC 2, ISO 27001, CCPA, and other applicable standards. Liaise with internal and external auditors to implement and sustain required controls.
• Vendor & Third-Party Risk: Build and manage a comprehensive vendor risk program, evaluating the cybersecurity and data protection controls of third parties, vendors, and business partners.
• GRC Program Maturation: Drive ongoing security program improvement by amplifying areas of strength and developing actionable plans to address gaps. Develop and report key metrics to security and business leadership.
• Data Governance & Protection: Lead data governance and data protection programs, ensuring alignment with enterprise risk management principles and up-to-date documentation of systems and processes.
• Controls & IT Compliance: Facilitate IT compliance across identified controls, including IT general controls (ITGCs), application, cloud, and cybersecurity controls.
• Policy & Communications: Document, communicate, and enforce security policies that balance risk with business operations. Champion cybersecurity best practices across all business units to reduce the organization’s attack surface.
• Incident Response: Oversee GRC-related incident response activities, tracking occurrences and resolutions with strict documentation and reporting protocols.
• Access Review: Manage the access review process to ensure appropriate access is consistently granted, maintained, and revoked.

Success Metrics

• Risk register is current, with documented mitigation plans and clear ownership for all identified risks.
• SOC 2, ISO 27001, and other applicable certifications and audits are managed on schedule with no critical findings.
• Vendor risk program covers all strategic third parties with completed assessments and remediation tracking.
• Security metrics are reported regularly to executive leadership with measurable program improvement over time.
• Security policies are actively communicated, adopted, and embedded across business units.
• Data governance documentation is current and aligned with enterprise risk and compliance requirements.

• 7–10+ years of experience in cybersecurity, spanning security analysis, compliance and regulatory affairs, risk management, or audit.
• Demonstrated experience leading and managing GRC programs, including risk registers, remediation planning, and executive-level reporting.
• Proven track record managing security audits and assessments for SOC 2, ISO 27001, GDPR, CCPA, and other standards; familiarity with PCI, HITRUST, and GLBA is a plus.
• H