Director, Governance Risk and Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead initiatives to evaluate the confidentiality, integrity, and availability of information through the organization's global ISMS framework.

• Evaluate adherence to company security policies.

• Manage internal and third-party risk management processes.

• Analyze and assess the effectiveness of information security controls.

• Collaborate with and provide guidance to systems architecture, systems deployments, and application configuration teams.

• Create and sustain ISMS documentation, encompassing policies, standards, and procedures.

• Advise the CISO, Product Management, Legal, and Finance leadership teams on aligning security programs with compliance requirements.

• Oversee information risk and collaboratively design and evaluate information security controls, including identity and access management.

• Stay informed about evolving regulations, security threats, and compliance best practices, updating policies and procedures as necessary.

• Enhance and promote organizational information security awareness.

• Convert business and information security requirements into the ISMS framework.

• Coordinate external audits with 3PAO, ISO/SOC auditors, PCI DSS QSA firms, and other security evaluators, including managing responses and remediation efforts.

• Conduct vendor risk assessments and ensure compliance with security and privacy standards by third parties.

• Review and supervise Security Incident Response and Business Continuity Management activities throughout business continuity and disaster recovery phases.

• Assess the effectiveness of ISMS controls and communicate results to senior management.

• Implement document control management processes for the ISMS.

• Support forecasting, planning, and risk assessment for evolving security control coverage in alignment with technology strategy.

• Keep abreast of industry knowledge and best practices.

• Research and suggest new technologies.

• Manage projects, including business requirements analysis, project planning, and completion tracking.

• Assist with vendor management, forecasting, and program budget oversight.

• Oversee personnel, including mentoring and cross-training team members.

⛳️ Requirements

• US Citizenship is required.

• A minimum of 10 years of hands-on experience in IT audit and/or compliance.

• Excellent documentation and communication abilities.

• Strong grasp of security standards and frameworks, including ISO27000 series, NIST Special Publication 800 series, SOC audits, and security obligations of Data Privacy laws.

• Proven experience in obtaining an ATO or P-ATO for cloud implementations under the FedRAMP, GovRAMP, or IL-4 programs.

• Familiarity with software development lifecycle methodologies, cloud and server infrastructures, and network technologies.

• Experience in managing security personnel and building collaborative relationships with global teams.

• Proficient in written and spoken English.

• Current CISA, CISM, CISSP, or an equivalent certification is highly preferred.

• Candidates must be legally authorized to work in the country where the position is located at the time of hire and must maintain that authorization throughout their employment.

• This position does not offer visa sponsorship or immigration assistance.

🏝️ Benefits

• Additional compensation such as company bonuses or benefits.

• Equal employment opportunity and affirmative action protections.