About this role

Build and lead a high-performing GRC/risk team including hiring, coaching, and performance management
Serve as the product owner for the GRC platform, setting vision, roadmap, priorities, and adoption goals
Act as a trusted advisor to senior leaders on risk appetite, emerging risks, and investment trade-offs
Design and implement an enterprise Information Security Risk Management program aligned to business strategy
Define and operationalize risk taxonomy, risk appetite/thresholds, and risk assessment methodologies
Engineer scalable workflows for risk assessments, control testing, issue management, and vendor risk
Establish a risk-based control testing and continuous control monitoring program
Mature third-party risk management with tiering, due diligence, and contract clauses

7-10 years progressive experience in Information Security, Risk, or Audit
3-5+ years leading teams and/or owning a GRC platform
Bachelor's Degree in Information Systems, Computer Science, Cybersecurity, or related; or equivalent experience
Strong knowledge of risk and control frameworks and regulations
Security or audit certifications: CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor, CISA
Background in cloud and modern engineering environments (AWS/Azure/GCP, DevSecOps, SaaS)
Hands-on experience designing automated workflows, building dashboards, and integrating GRC with IT/security tooling
Exceptional communication and stakeholder management skills

Senior Manager, Information Security Risk Management

Key skills