Description

You will own the governance, risk, and compliance program across the portfolio, ensuring regulatory adherence and managing technology risk.

This role is on-site.

Responsibilities

• Develop, maintain, and communicate the Information Security Policy suite across all portfolio entities.
• Build and manage technology risk registers and lead annual vendor risk assessments with security clause enforcement.
• Coordinate ISO 27001 and SOC 2 compliance efforts, including internal control assessments and maturity re-evaluations.
• Facilitate governance forums, track policy exceptions, and prepare board/executive-level risk reporting.
• Manage security awareness training programs, phishing simulations, and the data classification rollout.

Required Skills

• 5+ years of experience in GRC, audit, or Information Security compliance roles.
• Strong knowledge of ISO 27001, NIST CSF, SOC 2, and GDPR frameworks.
• Hands-on experience with GRC tools such as ServiceNow GRC, Archer, Vanta, Drata, or OneTrust.
• Proven ability to translate technical risks into business language for executive stakeholders.
• Excellent documentation, policy writing, and cross-functional communication skills.
• Experience managing risk registers and conducting vendor risk assessments.
• Proficiency in Microsoft tools and Power BI for reporting.

Preferred Skills

• Certifications in CISM, CISA, CRISC, or ISO 27001 Lead Implementer.
• Experience in multi-entity or portfolio-level governance environments.

Key Skills

Education

Bachelor's degree