Assoc Dir, Information Security Governance Risk & Compliance

SERVIER MONDE•Boston, MA

7d•$179,000 - $212,000•Hybrid

About The Position

The Associate Director, Information Security Governance Risk and Compliance serves as the functional leader for Governance, Risk and Compliance across the US affiliate, reporting to the Associate Director, Cybersecurity. This role establishes and leads the GRC operating model, governance framework, risk methodology, strategic priorities, and maturity roadmap. The role provides oversight of information security risk management, policy governance, compliance, third-party risk management, control assurance, audit readiness, and risk reporting while directing operational execution through subordinate managers, analysts, contractors, and service providers. This position partners closely with Global Information Security, IT, Legal, Privacy, Procurement, Quality, Internal Audit, and business stakeholders to ensure risks are identified, assessed, communicated, and managed in alignment with enterprise requirements. The role serves as the primary GRC advisor and enables risk-informed decision making by translating information security risk into business, operational, regulatory, and financial impact. This is a high visibility leadership role with the opportunity to build and scale a modern GRC capability aligned to Servier’s global cybersecurity strategy, enterprise risk expectations, regulatory obligations, and business growth.

Requirements

Minimum of 8+ years of experience in information security GRC, IT risk management, cybersecurity, compliance, audit, security operations, or related disciplines
Minimum of 3+ years in a leadership role with responsibility for program ownership, people leadership, functional leadership, or management of managers
Bachelor’s degree preferred in Cybersecurity, Information Technology, Information Systems, Business, Risk Management, or a related field
Deep expertise in information security risk frameworks and governance models, including NIST CSF 2.0, ISO 27001, PCI, SOX, FAIR, or similar methodologies
Experience leading policy governance, third-party risk management, compliance oversight, audit readiness, control assurance, and remediation governance programs
Strong executive communication skills with the ability to influence senior stakeholders in a global, matrixed organization

Nice To Haves

Relevant certifications such as CISSP, CISM, CRISC, CISA, CGRC, FAIR, or equivalent preferred

Responsibilities

Establish and lead the US information security risk management framework across the affiliate
Define risk assessment methodologies, risk taxonomy, scoring models, reporting standards, and escalation criteria
Provide oversight and challenge of risk assessments performed by the GRC team
Ensure information security risks are clearly defined, consistently assessed, and aligned to Group methodology and enterprise risk expectations
Review material risks, treatment recommendations, mitigation strategies, and risk acceptance proposals before escalation
Drive risk-based prioritization of remediation activities, investment recommendations, and control improvement initiatives
Serve as the senior US GRC leader responsible for coordinating information security risk governance across the affiliate
Act as the primary US liaison to Global Information Security for GRC-related risk, compliance, policy, and assurance activities
Establish governance routines, program cadences, reporting expectations, and execution standards for the US GRC function
Ensure alignment between US affiliate execution and Global risk management methodology, policy baselines, and governance expectations
Escalate material risks, systemic issues, overdue remediation, and governance concerns through US and Global governance channels
Establish governance expectations for information security policies, standards, procedures, control requirements, and exception management
Sponsor the local information security policy lifecycle, ensuring alignment with Global baselines, US business requirements, and regulatory obligations
Define the control assurance approach used to evaluate control design, implementation, effectiveness, and maturity
Oversee control monitoring, compliance validation, gap analysis, and continuous improvement activities
Define and monitor KPIs and KRIs measuring policy adoption, control maturity, security posture, remediation progress, and governance effectiveness
Establish the strategic direction for third-party information security risk management across the US vendor ecosystem
Define governance requirements, risk acceptance criteria, assessment standards, and escalation paths for third-party engagements
Partner with Procurement, Legal, Privacy, IT, and business stakeholders to ensure vendor security risks are appropriately assessed and managed
Oversee integration of third-party security risk into enterprise risk management, procurement processes, contractual reviews, and business decision making
Drive cross-domain alignment across Information Security, IT, Legal, Privacy, Procurement, Quality, and business functions
Oversee information security audit readiness across internal audits, external audits, regulatory engagements, and assurance activities
Establish governance over evidence collection, control validation, audit response, remediation tracking, and management reporting
Ensure audit findings, compliance gaps, and control deficiencies are translated into clear risk treatment plans with defined owners, timelines, and measurable outcomes
Partner with Internal Audit, Quality, Legal, Privacy, and Global Information Security to support assurance activities and regulatory expectations
Act as a trusted advisor on information security governance, risk, compliance, and assurance matters
Translate complex information security risks into business, operational, regulatory, financial, and reputational impact
Deliver executive-level reporting on information security risk posture, governance maturity, compliance status, control effectiveness, and remediation progress
Support governance committees, leadership forums, business reviews, and strategic planning discussions with clear risk-based recommendations
Represent US GRC priorities in Global information security and enterprise risk forums, influencing alignment where appropriate
Lead and develop the US Information Security Governance Risk and Compliance function
Manage GRC managers, analysts, contractors, consultants, managed service providers, and supporting resources
Define the GRC organizational structure, operating procedures, quality standards, workforce strategy, and capability development roadmap
Build scalable and repeatable GRC processes aligned to information security maturity objectives and organizational growth
Identify opportunities to improve efficiency through automation, process standardization, documentation quality, tooling, and operating model maturity