The Senior Manager, IT Security – GRC is responsible for leading and maturing the organization’s cybersecurity governance, risk management, and compliance programs. This role ensures cybersecurity risks are identified, assessed, and communicated effectively while aligning security controls with regulatory, contractual, and business requirements. This individual will partner closely with IT Infrastructure, Security Operations, Legal, Internal Audit, and business stakeholders to enable secure and compliant operations across the enterprise. The role requires the ability to translate complex technical risks into clear business impact for executive leadership.

Key Responsibilities:

Governance & Program Management:

• Lead and mature the enterprise GRC program, including policies, standards, procedures, and metrics
• Align cybersecurity frameworks with industry standards (NIST CSF, ISO 27001, CIS, SOC 2)
• Define and manage risk tolerance, exception management, and control ownership
• Ensure alignment between cybersecurity governance and enterprise risk management (ERM)

Risk Management:

• Lead cyber risk assessments, control gap analyses, and third-party risk evaluations
• Maintain enterprise risk register including scoring, remediation tracking, and treatment plans
• Partner with technical and business teams to mitigate, transfer, or accept risk
• Translate technical vulnerabilities into business-impact risk statements

Compliance & Assurance:

• Manage compliance across regulatory and industry frameworks (SOC 2, ISO, SOX, HIPAA, PCI, privacy)
• Serve as primary liaison for internal/external audits
• Coordinate audit responses, evidence collection, and remediation efforts
• Support customer security assessments, due diligence, and RFP responses
• Monitor regulatory changes and assess impact