GRC Manager – Technology Risk, Governance

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of and oversee the third-party risk management program, which includes risk-based vendor assessments, onboarding reviews, and regular evaluations throughout the vendor lifecycle.

• Collaborate with Information Security, Legal, Compliance, IT, and business stakeholders to identify, evaluate, document, and address technology, cybersecurity, privacy, AI, and vendor-related risks.

• Analyze SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration testing reports, business continuity plans, disaster recovery documents, privacy materials, and other compliance evidence.

• Engage with third-party auditors, vendors, and internal stakeholders to collect documentation, respond to assessment requests, and facilitate audit preparedness.

• Assist with responses to technology-related third-party questionnaires, ensuring the information provided is accurate, complete, consistent, and presented professionally.

• Keep well-organized records of assessments, risk documentation, compliance evidence, and supporting materials in line with internal policies and procedures.

• Create risk summaries, dashboards, reports, and governance materials for review by leadership and committees.

• Maintain and support Pinnacle Group’s ISO 27001 certification and SOC 2 compliance in collaboration with IT and other key stakeholders.

• Work with cross-functional teams to develop, maintain, and implement AI-related standards, procedures, and risk governance practices.

• Improve and sustain Pinnacle Group’s business continuity plan in partnership with relevant business and technology stakeholders.

⛳️ Requirements

• Bachelor’s degree in Business Information Systems, Cybersecurity, Risk Management, Compliance, or a related field.

• Experience in technology risk, governance, compliance, information security, auditing, third-party risk management, or a related field.

• Proven experience conducting vendor risk assessments for SaaS platforms, cloud providers, managed service providers, software vendors, and AI-enabled products.

• Familiarity with ISO 27001, SOC standards, NIST, CIS Controls, and related governance practices.

• Experience interacting with third-party auditors and responding to security, risk, compliance, or vendor assessment questionnaires.

• Capability to evaluate technology vendors, identify risk issues, document findings, and effectively communicate recommendations to both technical and non-technical stakeholders.

• Excellent written and verbal communication skills, with the ability to collaborate efficiently with auditors, vendors, IT, Legal, Compliance, and business teams.

• Experience utilizing Drata or similar governance, risk, and compliance platforms is preferred.

• Familiarity with AI-related risks, controls, governance standards, and emerging compliance considerations is preferred.

🏝️ Benefits

• Competitive salary and performance-based bonuses.

• Comprehensive health, dental, and vision insurance.

• Generous paid time off and flexible work arrangements.

• Professional development opportunities and training programs.

• Collaborative and inclusive company culture.