Senior Manager

Job Description – Security Governance & Risk Leader Position Title Security Governance, Risk & Compliance (GRC) Leader Department Information Security / Technology Reports To Chief Information Security Officer (CISO) / Chief Information Officer (CIO)/VP IT infrastructure and Information security Position Summary The Security Governance, Risk & Compliance (GRC) Leader is responsible for establishing and maintaining a robust security governance framework that aligns cybersecurity initiatives with organizational objectives, regulatory requirements, and industry best practices.

This role provides strategic leadership for information security governance, risk management, compliance, policy administration, audit readiness, and security oversight across the enterprise. The incumbent will work closely with executive leadership, business stakeholders, IT teams, auditors, regulators, and third-party partners to ensure that security risks are effectively managed, compliance obligations are met, and security controls support business growth while protecting organizational assets.

Key Responsibilities

1. Security Governance & Strategy Develop and implement enterprise-wide cybersecurity governance frameworks aligned with business objectives and regulatory requirements. Define, maintain, and enforce information security policies, standards, procedures, and guidelines. Establish governance structures, security committees, and reporting mechanisms to support security oversight. Partner with executive leadership to align security strategy with organizational goals and risk appetite. Develop security roadmaps and maturity improvement programs based on industry frameworks and emerging threats. Present security governance updates, risk posture, and compliance status to executive management and board committees.
2. Security Risk Management & Compliance Establish and maintain an enterprise information security risk management framework. Identify, assess, monitor, and mitigate cybersecurity risks affecting business operations and technology environments. Maintain security risk registers and track remediation activities to closure. Ensure compliance with applicable regulatory, legal, and contractual requirements, including: ISO 27001 NIST Cybersecurity Framework GDPR HIPAA PCI-DSS SOX RBI and other regional regulatory requirements Conduct compliance assessments and readiness reviews for certifications and audits. Collaborate with business units to implement risk treatment and control improvement plans.
3. Security Controls & Policy Management Design, implement, and monitor security control frameworks across infrastructure, applications, cloud platforms, and business processes. Oversee periodic review and enhancement of security policies and procedures. Ensure organization-wide awareness and adherence to security standards. Lead control testing, effectiveness evaluations, and compliance validation activities. Monitor key security controls including: Identity and Access Management (IAM) Privileged Access Management (PAM) Change Management Data Protection Endpoint Security Cloud Security Controls Business Continuity and Disaster Recovery
4. Information Security Governance & Security Oversight Collaborate with the CISO and security operations teams to drive cybersecurity governance initiatives. Monitor compliance with internal security standards and industry best practices. Oversee security assessment programs including: Vulnerability Assessments Penetration Testing Security Architecture Reviews Cybersecurity Maturity Assessments Support security incident management and crisis response governance processes. Review threat intelligence, emerging risks, and cybersecurity trends to strengthen organizational resilience. Ensure periodic reporting of security metrics, risks, incidents, and remediation activities.
5. Security Program & Operational Governance Establish governance frameworks for security initiatives, projects, and transformation programs. Oversee security budgeting, planning, and resource prioritization. Monitor vendor security performance and third-party risk management programs. Ensure security requirements are integrated into technology projects and procurement processes. Track security KPIs, KRIs, and service-level metrics to drive continuous improvement. Evaluate effectiveness of security investments and governance programs.
6. Audit Management & Regulatory Coordination Act as the primary liaison for internal and external security audits. Coordinate audit planning, evidence collection, and stakeholder engagement activities. Review audit findings and develop remediation plans. Ensure timely closure of audit observations and compliance gaps. Support regulatory examinations and customer security assessments. Maintain documentation required for compliance certifications and governance reviews.
7. Stakeholder Management & Leadership Serve as the key liaison between Information Security, IT, Risk, Legal, Compliance, Audit, and Business Units. Build strong relationships with executive leadership and business stakeholders. Promote a culture of security awareness, accountability, and compliance throughout the organization. Lead and mentor governance, risk, and compliance teams. Drive security training, awareness, and communication initiatives across the enterprise. Provide strategic recommendations to leadership regarding security investments, risk mitigation, and governance improvements.

Requirements

Qualifications & Experience Education Bachelor's Degree in Computer Science, Information Technology, Cybersecurity, Information Systems, or a related discipline. Master's Degree (MBA, MS Information Security, or equivalent) preferred. Experience 12+ years of experience in Information Security, IT Governance, Risk Management, Audit, or Compliance.

Minimum 5+ years in a leadership or management role within Security Governance, Risk, and Compliance. Proven experience implementing and managing enterprise security governance frameworks. Hands-on experience managing security audits, risk assessments, compliance programs, and security control frameworks. Strong understanding of enterprise technology environments, cloud security, cybersecurity operations, and regulatory requirements.

Preferred Certifications Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) Certified in Risk and Information Systems Control (CRISC) Certified Information Systems Security Professional (CISSP) COBIT Foundation / Design & Implementation ISO 27001 Lead Auditor or Lead Implementer ITIL Foundation or Expert Certified Cloud Security Professional (CCSP) – Preferred Key Competencies Leadership & Strategy Strategic thinking and business alignment Executive presence and influencing skills Decision-making and governance leadership Risk & Compliance Security risk assessment and mitigation Regulatory compliance management Control design and validation Technical Knowledge Information security frameworks and standards Cybersecurity governance and operations Cloud security and data protection Communication & Collaboration Stakeholder management Board and executive reporting Negotiation and conflict resolution Presentation and communication excellence Operational Excellence Program and project governance Process improvement and optimization Performance measurement and reporting Key Performance Indicators (KPIs) Governance & Compliance Audit compliance score Number of repeat audit findings Timely closure of audit observations Regulatory compliance adherence rate Risk Management Reduction in high-risk findings Risk remediation closure percentage Security control effectiveness scores Risk assessment completion rates Security Program Effectiveness Security maturity assessment improvement Security policy compliance rate Third-party risk assessment completion rate Vulnerability remediation performance Operational Metrics SLA adherence for security governance activities Budget utilization and optimization Security project delivery success rate Service delivery performance metrics Stakeholder Satisfaction Business stakeholder satisfaction score Executive reporting effectiveness Security awareness adoption metrics Alignment of security initiatives with business objectives Job Level: Senior Manager / Director / Head of Information Security Governance & Risk Management