Description

REQUIRED QUALIFICATIONS

• Experience: 6+ years of IT Governance, Risk and Compliance (GRC) experience in technology, retail, or similar fast-paced environments.
• Education: Bachelor’s degree in Computer Science or a related field (or equivalent combined experience).
• Program Building: Proven track record of building and scaling compliance programs and controls from the ground up.

REQUIRED TECHNICAL SKILLS & FRAMEWORKS

• GRC Frameworks: Hands-on experience with NIST, FAIR, ISO and IT General Controls (ITGC).
• Regulatory & Compliance Standards: Deep knowledge of CCPA/CPRA, PCI DSS, SOX and data privacy requirements.

CORE DOMAINS:

• Cloud Security (IaaS, PaaS, SaaS)
• Identity and Access Management (IAM)
• Third-Party Risk Management (TPRM)
• Change Management & Data Protection

PREFERRED QUALIFICATIONS & TOOLS

• GRC Tools: Experience with ServiceNow, OneTrust, OnSprig, or Audit Command Language (ACL).
• Certifications: CISSP, CISA, CRISC, CISM, or SANS GIAC.
• Industry Background: Prior experience in Retail, Big 4 IT Audit, Internal IT Audit, or Security Consulting.
• Specialization: Strong expertise in California privacy compliance (CCPA/CPRA).

KEY RESPONSIBILITIES

• Compliance Execution: Own and execute compliance programs focusing on PCI DSS, CCPA/CPRA and emerging cybersecurity regulations.
• Audit & Control Assessments: Plan, coordinate and perform control testing, evidence collection and scope definition for technical audits.
• Requirement Translation: Translate complex legal and regulatory rules into clear, sustainable technology control requirements and procedures.
• Remediation Management: Track compliance findings, gaps and remediation plans from identification to closure.
• Cross-Functional SME: Act as primary GRC advisor across IT, InfoSec, Legal, Privacy and Internal Audit teams.
• Reporting & Metrics: Develop status updates, dashboards and risk metrics for senior leadership

Key Skills

Education

Bachelor's degree