Director – Governance, Risk and Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Spearhead initiatives to evaluate the confidentiality, integrity, and availability of information via the company's global ISMS framework.

• Create and uphold ISMS documentation, which encompasses policies, standards, and procedures.

• Advise the CISO, Product Management, Legal, and Finance leadership teams on aligning the security program with compliance requirements.

• Oversee information risk and collaboratively design and evaluate information security controls, including identity and access management.

• Keep track of regulatory environments, security threats, and compliance best practices; revise policies and procedures accordingly.

• Enhance and sustain organizational information security awareness.

• Convert business and information security requirements into the ISMS framework.

• Organize external audits with 3PAO, ISO/SOC auditors, PCI DSS QSA firms, and other assessors.

• Coordinate responses to audits and remediation initiatives.

• Perform vendor risk evaluations and ensure third-party adherence to security and privacy standards.

• Review and supervise Security Incident Response and Business Continuity Management activities.

• Assess the effectiveness of ISMS controls and communicate results to senior management.

• Implement document control management processes for the ISMS.

• Support forecasting, planning, and risk evaluation aligned with technology strategy.

• Stay updated with industry knowledge and suggest new technologies.

• Manage projects, including requirements analysis, project planning, and tracking completion.

• Assist with vendor management, forecasting, and program budget oversight.

• Guide personnel through mentoring and cross-training.

⛳️ Requirements

• Must be a US Citizen.

• At least 10 years of practical experience in IT audit and/or compliance.

• Excellent documentation and communication abilities.

• Strong comprehension of the ISO27000 series, NIST Special Publication 800 series, SOC audits, and the security requirements of Data Privacy laws.

• Prior experience in obtaining an ATO or P-ATO for a cloud deployment under FedRAMP, GovRAMP, or IL-4 programs.

• Knowledge of software development lifecycle methodologies, cloud and server infrastructure, and network technologies.

• Experience in managing security personnel and collaborating with global teams.

• Proficient in written and spoken English.

• Current CISA, CISM, CISSP, or equivalent certification is highly preferred.

• Must be legally authorized to work in the country of the role.

• Must maintain work authorization throughout the duration of employment.

• No visa sponsorship or immigration assistance will be provided.

🏝️ Benefits

• Additional compensation options, such as company bonuses or benefits.

• Equal employment opportunity/affirmative action protections.