Overview In this role you lead enterprise security risk and compliance, shaping strategy, owning GRC outcomes, and ensuring regulatory alignment across the company and subsidiaries. You'll build and sustain the enterprise GRC framework and oversee attestations and certifications, reporting to C-suite and the Board. You guide security policy, risk tracking, and third-party risk, enabling consistent risk identification, remediation, and reporting. You also drive threat and vulnerability processes, policy adherence, and continuous improvements in risk management capabilities. This position includes budget stewardship and cross-functional alignment with Legal, Compliance, IT, and business stakeholders.
Compensation / Benefits- health and wellness benefits
- 401(k) savings plan
- pension plan
- paid time off
- tuition reimbursement
- annual incentive bonus plan
Responsibilities- Set enterprise GRC strategy and own outcomes
- Oversee attestations/certifications (SOX, HIPAA, HITRUST) with executive/Board reporting
- Govern security policy, awareness, and third-party risk management
- Ensure risk identification, tracking, remediation, and reporting across the enterprise
- Manage threat and vulnerability management processes
- Ensure adherence to risk policies and standards; drive capability improvements
- Own information security risk posture and budget; coordinate with Legal, Compliance, IT, and business stakeholders
Key requirements- Bachelor's degree and 15 years in IT/Information Security; or 19 years without a degree
- Minimum 7 years of people leadership experience (multi team leadership preferred)
- Proven experience leading enterprise GRC programs (risk, compliance, policy, third party risk, subsidiary governance)
- Experience briefing executives/Board, budgeting, and driving cross functional outcomes
- leadership
- stakeholder management
- clear communication
- enterprise GRC program leadership
- risk management and third party risk
- security policy and compliance
