GRC & Security Governance Lead

About the company

• Position listed on behalf of a partner company that manages all applications and next steps.
• Based in the United States.
• Growing, publicly traded financial technology environment.

Responsibilities

• Build and lead the technology governance program covering technology and cybersecurity risk, IT controls, change management, incident management, business continuity, and security policies.
• Develop and maintain a centralized inventory of technology controls, including control owners, evidence requirements, operating schedules, exception processes, and escalation pathways.
• Lead technology assurance activities across SOC 2, SOX IT General Controls (ITGC), PCI, and other applicable compliance frameworks.
• Own the technology and cyber risk register, assess risk exposure and materiality, document control exceptions, and communicate significant risks.
• Establish clear expectations for control owners and technical teams.
• Define practical policies and oversight processes for technology changes, security incidents, and operational disruptions.
• Establish and maintain governance requirements supporting operational continuity and recovery.
• Identify and implement AI-assisted and automated workflows for evidence analysis, control mapping, policy maintenance, risk reporting, audit preparation, and remediation tracking.
• Collaborate with Security, IT, Engineering, SRE, Data, Compliance, Legal, Internal Audit, and external assessors.
• Escalate material risks effectively and ensure appropriate visibility and timely decisions.
• Develop clear documentation, reporting structures, decision records, action plans, and performance indicators.
• Evaluate the effectiveness of governance processes and refine the operating model.

Requirements

• At least eight years of relevant technology experience, including substantial responsibility for security governance, technology risk management, or security assurance.
• Direct experience leading a SOC 2 Type II, ISO 27001, or equivalent audit through a successful outcome.
• Demonstrated experience creating or materially redesigning a governance, risk, or assurance operating model.
• Solid understanding of modern technology environments, including cloud infrastructure, identity and access management, CI/CD pipelines, source control, endpoints, networks, and data platforms.
• Ability to translate ambiguous security or compliance requirements into precise, testable controls.
• Experience assessing risk severity and materiality, managing exceptions, and escalating significant issues.
• Ability to establish credibility with Engineering, SRE, Security, IT, and Data teams.