Cybersecurity GRC Manager

Title: Cybersecurity GRC Manager

Location: Remote

Reports to: Chief Information Security Officer (CISO)

Job Purpose: LTK is looking to add a Cybersecurity GRC Manager who can lead our efforts in governance, risk, and compliance responsibilities from a security and technology perspective across the organization. This individual will lead the Security GRC Team and will be directly responsible for implementing, maintaining, and improving policies, procedures, and internal controls to assure compliance with applicable regulatory and legal requirements, as well as best practices.

As a GRC Manager, you'll be working to improve the Security Risk Management Program and work closely with various teams such as DevOps, Engineering, and Product teams. The GRC manager will oversee global security strategy and programs fostering a culture where security is everyone’s responsibility. The right person for this role will have experience with guidelines, standards and policies across different businesses and industries.High touch, global organization with exposure to IT systems and helping to build the foundation that will drive business transformation.

Qualifications: 

The ideal candidate is someone who has:

• 8 + years of IT/Cybersecurity experience in relevant security domains (e.g. compliance, audit, security risk management)
• 3+ years of Project Management experience
• Deep knowledge of and hands-on experience with Amazon Web Services (AWS)
• Created and built a Project Managing IT Governance, Risk, or Compliance (GRC) process from scratch
• Experience as the main point of contact for GRC related initiatives and has worked cross-functionally with internal teams: Legal, Privacy, Tech, IT Vendor Management and other business unites
• Direct experience managing SOC2 readiness activities as well as remediation and certification efforts
• Managed compliance initiatives across business units e.g. GDPR, CCPA, PCI, Privacy, Internal/External Audits, 3rd Party Vendor Management and SOC2 
• One or more industry certificates e.g. CISM, CRISC, CISA, CIPM, CISSP

Key Responsibilities:

• Manage the remediation of risks identified through the risk register process and contribute towards improving the overall risk management program. It may include leading annual security assessments, completing written reports of results to be shared with the Executive Leadership Team and other senior leaders.
• Continuously improve the Information Security Risk Management Program and oversee a Business Continuity Program
• Develop and maintain all relevant documentation, policies, standards, guidelines and frameworks, embedding controls into processes across the business and technology units.
• Assists in the early identification of risk trends by establishing and monitoring key performance and key risk indicators via Risk and Business Impact Assessments.
• Educates risk owners on risk management best practices and works with other risk functions (e.g. Internal Audit and Legal) in the development and implementation of risk controls and treatment plans.
• Lead the security exception process, including leading the completion of security exceptions, tracking and following up on alternative mitigating action items included within approved security exceptions.
• Manage relationships with key internal stakeholders providing transparency on broader Information Security program’s operational efficiency including timelines and budget
• Manage the creation of new or leading the maintenance of existing security and privacy policies, standards and specifications to ensure they are current and appropriately aligned with applicable laws, regulations, and the evolution of security risks
• Support the maintenance and build-out of repositories, tools, and documentation for third party risk assurance