Director, Cybersecurity GRC

KLDiscovery•United States,

About The Position

The Director, Cyber GRC leads the Governance, Risk, and Compliance function across Governance & Risk Management, Compliance & Audit, and Client Trust. This is a player-coach leadership role reporting directly to the CISO and partnering with the Director, Cyber Operations as part of a unified cyber team. The role works closely with business stakeholders to ensure the cyber risk and compliance posture supports business growth. The Director owns and matures the cyber risk register, risk appetite and tolerance framework, governance structure, policy lifecycle, compliance calendar, assessor relationships, continuous compliance posture, GRC platform strategy, audit readiness, and technical control validation. The role also monitors regulatory changes and assesses certification needs based on competitive and client requirements. A core expectation is modernizing GRC operations through AI and automation. This includes implementing AI-assisted evidence gathering, controls mapping, and compliance monitoring; consolidating overlapping framework controls into a unified evidence set; evaluating AI-enabled GRC tools; and advancing questionnaire, vendor risk, and policy workflow automation. The role oversees Client Trust and Vendor Risk Management, including the Trust Center, enterprise security questionnaires, client audit support, third-party assessments, due diligence, and remediation tracking. It also directs company-wide security awareness and training, leads and develops a lean GRC team, provides program reporting and metrics to the CISO, and builds a culture of continuous improvement and automation-first execution.

Requirements

15+ years of progressive experience in information security, including a minimum of 7 years in a GRC leadership role.
Demonstrated ownership of multi-framework compliance programs at Director or equivalent level.
Proven track record managing external assessor relationships.
Hands-on experience deploying or significantly maturing a GRC platform.
Demonstrated experience implementing AI or automation within a GRC or compliance function.
Deep working knowledge of NIST SP 800-171, NIST CSF, ISO 27001:2022, SOC 2, PCI DSS, GDPR, and HIPAA Security Rule.
Understanding of technical security controls sufficient to evaluate control design and operating effectiveness.
Familiarity with cloud-native architectures and compliance strategies for SaaS-heavy environments.
Exceptional communication skills, including translating complex cyber risk and compliance concepts into clear business language for executives, clients, and regulators.
Collaborative, client-facing presence and comfort leading enterprise security discussions and due diligence meetings.
Business-minded judgment to balance security and compliance requirements with commercial realities without sacrificing rigor.
Growth mindset, curiosity, and interest in a fast-growing company and evolving regulatory and threat landscape.
Discretion, sound judgment, confidentiality, and professionalism.
Bachelor's degree in Information Security, Computer Science, Business, or a related field.

Nice To Haves

Experience managing Big 4 or specialist external assessors is preferred.
Experience with federal frameworks such as FedRAMP or CMMC.
Experience with AI governance frameworks such as NIST AI RMF or ISO 42001.
Professional certifications such as CISSP, CISA, CRISC, CISM, or GIAC.
Master's degree or MBA with a security focus.

Responsibilities

Own and mature the cyber risk register, transitioning from qualitative to quantitative risk assessment.
Define and maintain the cyber risk appetite and tolerance framework in partnership with the CISO.
Lead governance structures, including policy lifecycle, RACI design, and security steering committee support.
Standardize policies and procedures across the business while balancing security, compliance, and operational realities.
Own the annual compliance calendar across frameworks and manage relationships with external assessors.
Maintain continuous audit readiness, with evidence prepared throughout the year.
Oversee GRC platform strategy, advancing automated evidence collection, continuous controls testing, and real-time compliance monitoring.
Conduct pre-assessment readiness reviews and internal controls testing, and manage post-audit findings.
Lead technical control validation to confirm deployed cyber controls operate as intended and are documented.
Monitor regulatory changes and assess the need for further certifications based on competitive and client requirements.
Transform GRC operations through AI and automation, including AI-assisted evidence gathering, controls mapping, and compliance monitoring.
Maintain a unified cyber framework approach that consolidates overlapping controls across ISO, SOC 2, NIST, and HIPAA into a single evidence set.
Evaluate and integrate GRC tooling for risk quantification, anomaly detection, and audit automation.
Champion questionnaire automation, vendor risk tooling, and policy workflow automation.
Oversee Client Trust, including Trust Center strategy, enterprise security questionnaires, and client audit support.
Own the Vendor Risk Management program, including third-party tiering, assessment lifecycle, due diligence, and remediation tracking.
Engage enterprise clients and prospects on security posture, due diligence requirements, and audit inquiries.
Direct the company-wide security awareness program, using metrics to measure effectiveness and drive behavioral change.
Develop and execute an annual security awareness strategy with defined objectives, milestones, and measurable outcomes.
Ensure role-appropriate security training is current and delivered as planned across the organization and cybersecurity department.
Lead, develop, and performance-manage a lean GRC team across three functional pillars.
Partner with the Director of Cybersecurity Operations as a unified cyber function reporting to the CISO.
Build a team culture of continuous improvement, automation-first execution, and cyber-informed compliance.
Provide the CISO regular reporting and metrics on program health, risk posture, and compliance status.