Director, Cybersecurity GRC

Director, Cyber GRC

Role Overview

The Director, Cyber GRC leads the Governance, Risk, and Compliance function across three operational cyber pillars: Governance & Risk Management, Compliance & Audit, and Client Trust. This is a player-coach leadership role reporting directly to the CISO, partnering with the Director, Cyber Operations as one unified cyber team. The role partners closely with the business stakeholders to ensure the cyber risk and compliance posture supports business growth.

Key Responsibilities

Cyber Governance & Risk Management

• Own and mature the cyber risk register, transitioning from qualitative to quantitative risk assessment
• Define and maintain the cyber risk appetite and tolerance framework in partnership with the CISO
• Lead governance structure including policy lifecycle, RACI design, and security steering committee support
• Standardize policies and procedures across the business to facilitate strong security and meet compliance requirements, while maintaining practical balance with operational realities

Compliance & Audit Management

• Own the annual compliance calendar across all frameworks and manage assessor relationships with external assessors
• Build and maintain a continuous compliance posture — evidence always audit-ready, not reconstructed at assessment time
• Oversee the GRC platform strategy, driving toward automated evidence collection, continuous controls testing, and real-time compliance monitoring
• Conduct pre-assessment readiness reviews, internal controls testing, and post-audit findings management
• Lead technical control validation, confirming that deployed cyber controls operate as intended and documented
• Monitor regulatory changes and assess the need for further certifications against competitive and client requirements

AI, Automation & GRC Modernization

• Lead the transformation of GRC operations through AI and automation — a core expectation, not a future aspiration
• Implement AI-assisted evidence gathering, controls mapping, and compliance monitoring to reduce manual effort and improve program quality
• Maintain a unified cyber framework approach that consolidates overlapping controls across ISO, SOC 2, NIST, HIPAA into a single evidence set
• Evaluate and integrate GRC tooling that leverages AI for risk quantification, anomaly detection, and audit automation
• Champion questionnaire automation, vendor risk tooling, and policy workflow automation across the GRC team

Client Trust & Vendor Risk Management

• Oversee the Client Trust function — Trust Center strategy, enterprise security questionnaire program, and client audit support
• Own the Vendor Risk Management program including third-party tiering, assessment lifecycle, due diligence, and remediation tracking
• Serve as a credible, client-facing security leader who can engage enterprise clients and prospects directly on security posture, due diligence requirements, and audit inquiries

Security Awareness & Training

• Direct the company-wide security awareness program using metrics to measure effectiveness and drive behavioral change
• Develop and execute an annual security awareness strategy with defined objectives, milestones, and measurable outcomes
• Ensure role-appropriate security training exists, is current, and is being delivered as planned across the organization and to the cybersecurity department

Team Leadership

• Lead, develop, and performance-manage a lean GRC team across three functional pillars
• Partner with the Director of Cybersecurity Operations as a unified cyber function reporting to the CISO
• Build a team culture of continuous improvement, automation-first execution, and cyber-informed compliance
• Provide regular reporting and metrics to the CISO on program health, risk posture, and compliance status

Qualifications

Experience

• 15+ years of progressive experience in information security, with a minimum of 7 years in a GRC leadership role
• Demonstrated ownership of multi-framework compliance programs at a Director or equivalent level
• Proven track record managing external assessor relationships (Big 4 or specialist assessors preferred)
• Hands-on experience deploying or significantly maturing a GRC platform (AuditBoard, ServiceNow GRC, Archer, Vanta, or equivalent)
• Demonstrated experience implementing AI or automation within a GRC or compliance function

Technical Knowledge

• Deep working knowledge of NIST SP 800-171, NIST CSF, ISO 27001:2022, SOC 2, PCI DSS, GDPR, HIPAA Security Rule
• Understanding technical security controls sufficiently to evaluate control design and operating effectiveness — this is not a purely administrative compliance role
• Experience with federal frameworks (FedRAMP, CMMC) is a meaningful differentiator
• Experience with AI governance frameworks (NIST AI RMF, ISO 42001) is a meaningful differentiator
• Familiarity with cloud-native architectures and compliance strategies for SaaS-heavy environments

General Abilities

• An exceptional communicator — able to translate complex cyber risk and compliance concepts into clear business language for executives, clients, and regulators alike
• A natural collaborator and client-facing presence — comfortable leading enterprise client security discussions, representing in due diligence meetings, and building trust with external stakeholders
• Business-minded — you understand what matters to the business and balance security and compliance requirements against commercial realities, making practical decisions without sacrificing rigor
• A continuous learner with a growth mindset and genuine curiosity — passionate about working in a fast-growing company and staying ahead of a rapidly evolving regulatory and threat landscape
• Discreet and trusted — you exercise sound judgment, maintain confidentiality, and operate with the professionalism appropriate

Education

• Bachelor's degree in Information Security, Computer Science, Business, or a related field required
• Professional certifications such as CISSP, CISA, CRISC, CISM, GIAC
• Master's degree or MBA with a security focus is preferred