Lead Governance, Risk and Compliance Manager

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead and enhance Cohere’s Governance, Risk, and Compliance (GRC) program by implementing scalable governance processes, operational procedures, risk management practices, and measurable performance indicators.

• Take ownership of the deployment, configuration, and optimization of enterprise GRC platforms, which includes control mapping, evidence automation, risk registers, continuous monitoring, and compliance reporting.

• Direct compliance and certification efforts across HITRUST, HIPAA, ISO 27001, and relevant regulatory requirements.

• Manage customer security assurance activities, which encompass security questionnaires, due diligence requests, customer audits, executive briefings, and security discussions.

• Collaborate with Sales, Customer Success, and Marketing to create security-focused go-to-market materials and maintain a customer-facing Trust Center.

• Review and negotiate security-related contractual requirements with the Legal team, including Data Protection Agreements (DPAs), Business Associate Agreements (BAAs), security exhibits, and customer security obligations.

• Oversee enterprise risk management, including conducting risk assessments, tracking remediation, managing exceptions, and reporting on vulnerability remediation service level agreements (SLAs).

• Govern identity and access compliance, which includes access reviews, privileged access certifications, segregation of duties, and addressing access control deficiencies.

• Establish cross-functional GRC engagement to align policies, controls, risk ownership, and compliance obligations with operational priorities.

• Create executive presentations, dashboards, and reports on compliance posture, risk exposure, remediation performance, customer assurance metrics, and program maturity.

• Build and scale a high-performing GRC function, enhance team capabilities, manage external assessors and partners, and promote continuous improvement.

⛳️ Requirements

• A minimum of 8 years of progressive experience in information security, governance, risk management, compliance, or IT audit, including at least 2 years in leadership roles for GRC initiatives, programs, and/or teams.

• Possession of professional certifications such as CISM, CISSP, CRISC, CISA, CGRC, or HITRUST CCSFP.

• Extensive knowledge of HITRUST, ISO 27001, and HIPAA, including hands-on experience managing assessments, implementing controls, coordinating audits, and ensuring certification readiness.

• Proven experience deploying and managing enterprise GRC platforms, which includes implementation, workflow design, control mapping, evidence collection, reporting, and process automation.

• Familiarity with the NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO 27017, ISO 27018, ISO 42001, and privacy-related security requirements.

• Strong understanding of enterprise risk management, including risk registers, control assessments, risk treatment plans, vulnerability remediation SLAs, and formal exception management.

• Demonstrated project and program management skills, such as managing multiple concurrent initiatives, developing operational roadmaps, establishing KPIs, and delivering results independently.

• Proven experience in leading customer assurance programs, including managing security questionnaires, conducting security meetings with customers, performing due diligence reviews, and responding to enterprise customer requirements.

• Experience with GRC platforms like Vanta, Anecdotes, ZenGRC, Drata, ServiceNow GRC, or comparable enterprise solutions.

• Successful track record in developing GRC program maturity models, executive scorecards, and risk-based reporting frameworks.

• Exceptional written and verbal communication skills, along with expertise in executive presentations and analytical reporting, capable of translating complex security and compliance requirements into actionable business insights.

• Working knowledge of contractual security requirements, including reviewing and redlining security exhibits, DPAs, BAAs, and customer agreements in collaboration with Legal.

• Proven ability to partner with Sales, Customer Success, and business stakeholders to create customer assurance materials, security documentation, and go-to-market enablement resources.

• Experience in designing, launching, or managing a customer-facing Security Trust Center and related assurance workflows.

• Background in healthcare technology, SaaS, AI/ML-driven organizations, or other highly regulated environments.

🏝️ Benefits

• Fully remote opportunity with approximately 5% travel.

• Comprehensive medical, dental, vision, life, and disability insurance, alongside an Employee Assistance Program.

• 401K retirement plan with company match.

• Flexible spending and health savings accounts.

• Flex Time Off plus company holidays.

• Up to 14 weeks of paid parental leave.

• Pet insurance.

• Bonus included in the total benefits package.