Position Overview
We are seeking an experienced IT Risk and Compliance Lead to establish, maintain, and oversee our organization's information security and compliance framework. This role will be responsible for ensuring IT operations align with regulatory requirements, industry standards, and organizational policies while managing risk across the technology landscape.
Key ResponsibilitiesRisk Management
- Lead the identification, assessment, and mitigation of IT and cybersecurity risks across the organization
- Develop and maintain the IT risk register, tracking risk exposure and remediation efforts
- Conduct regular risk assessments of systems, applications, and infrastructure
- Partner with business units to evaluate technology risks associated with new initiatives and third-party relationships
- Implement and oversee the vendor risk management program for technology suppliers
Compliance & Governance
Ensure compliance with relevant regulations and standards including SOC Type 1 and Type 2, ISO 27001, GDPR, HIPAA, PCI-DSS, or other industry-specific requirementsManage audit processes and serve as primary liaison with internal and external auditorsDevelop and maintain IT policies, standards, and procedures aligned with compliance requirementsMonitor changes in regulatory landscape and assess impact on the organizationCoordinate compliance activities across IT and business functionsSecurity & Controls
Design, implement, and monitor IT controls framework to mitigate identified risksOversee vulnerability management and remediation programsConduct security control testing and effectiveness assessmentsLead incident response planning from a compliance and risk perspectiveCollaborate with security teams to align risk priorities with security initiativesReporting & Communication
Prepare executive-level reports on IT risk posture, compliance status, and key metricsPresent findings and recommendations to senior leadership and board committeesDevelop key risk indicators (KRIs) and compliance dashboardsCommunicate complex technical risks in business terms to stakeholders at all levelsRequired QualificationsExperience
7-10 years of progressive experience in IT risk management, compliance, audit, or related fieldsDemonstrated experience managing compliance programs for major frameworks (SOC 2, ISO 27001, NIST, etc.)Proven track record of successfully leading audit and assessment activitiesExperience conducting IT risk assessments and developing remediation strategiesBackground in vendor risk management and third-party assessmentsTechnical Skills
Strong understanding of information security principles, controls, and best practicesKnowledge of cloud security frameworks (AWS, Azure, GCP)Familiarity with security technologies including SIEM, vulnerability scanning, and access management toolsUnderstanding of network architecture, system infrastructure, and application securityExperience with GRC (Governance, Risk, and Compliance) platformsCertifications
One or more relevant certifications required : CISA, CRISC, CISSP, CISM, or equivalentAdditional certifications are a plus : ISO 27001 Lead Auditor, CDPSE, or cloud security certificationsSoft Skills
Excellent written and verbal communication skills with ability to influence stakeholdersStrong analytical and problem-solving capabilitiesAbility to work independently and manage multiple priorities simultaneouslyCollaborative approach with ability to build relationships across technical and business teamsDetail-oriented with strong organizational and project management skillsPreferred Qualifications
Experience in a leadership or team lead capacityIndustry-specific compliance experience relevant to our sectorExperience implementing compliance automation and continuous monitoring solutionsUnderstanding of DevSecOps and shift-left security practices