Director of Governance, Risk & Compliance

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Director of Governance, Risk & Compliance based in the United States.

• Own and mature the internal GRC program and lead the operational delivery of Managed GRC services, establishing standardized methodologies, processes, templates, evidence requirements, and quality controls.
• Lead risk assessments, control assessments, compliance readiness activities, policy governance, managed audits, managed security questionnaires, and other GRC engagements.
• Lead federal compliance activities, including the development and maintenance of System Security Plans, control implementation statements, supporting evidence, POA&Ms, remediation plans, milestones, and responses to government, assessor, and auditor findings.
• Coordinate with engineers, security teams, control owners, and clients to validate how security controls are implemented.
• Support requirements related to NIST SP 800-53, NIST SP 800-171, FISMA, CMMC, FedRAMP concepts, and agency-specific federal security requirements.
• Manage cybersecurity risk and compliance programs covering risk registers, control gaps, treatment plans, exceptions, remediation tracking, SOC 2, NIST, CIS, ISO 27001, PCI DSS, HIPAA, CMMC, and Microsoft security benchmarks.
• Oversee managed audit and security questionnaire methodologies.
• Partner with senior security leadership to operate and strengthen internal compliance initiatives.
• Act as a senior GRC advisor to client security, IT, risk, compliance, and executive leaders.
• Collaborate with Security Operations, cloud, Microsoft 365, and engineering teams to map compliance requirements to technical implementations.
• Support vCISO engagements where governance, risk, audit, and compliance expertise is required.
• Lead, mentor, and develop GRC Analysts and Consultants.
• Identify opportunities to use automation and AI to improve GRC delivery.

• 8+ years of experience in cybersecurity, Governance, Risk & Compliance, security assessment, audit, or a related field.
• Hands-on experience with NIST SP 800-53, System Security Plans, POA&Ms, control implementation statements, and federal security requirements.
• Proven experience managing audits, evidence programs, risk assessments, control gaps, policies, remediation initiatives, and compliance activities.
• Ability to translate regulatory and compliance requirements into practical technical and operational security controls.
• Strong understanding of frameworks and standards such as SOC 2, NIST, CIS, ISO 27001, PCI DSS, HIPAA, CMMC, and Microsoft security benchmarks.
• Strong client-facing, executive communication, facilitation, and stakeholder management skills.
• Ability to work directly with engineers and control owners.
• Experience in an MSSP, MSP, consulting, professional services, federal program, or government contractor environment is preferred.
• Experience with Microsoft Azure and Microsoft 365 security technologies is strongly preferred.
• Familiarity with Azure, Entra ID, Defender, Sentinel, Intune, Purview, and Azure Policy.

• This is a remote U.S. role with the option to work from home or from a local U.S. office.