Director; Governance, Risk & Compliance

Cosm•Los Angeles, CA

10h•$210,000 - $225,000

About The Position

Cosm is seeking a seasoned Governance, Risk, and Compliance (GRC) professional to help lead and evolve our enterprise-wide security governance and risk management programs. Reporting to the Information Security Officer (ISO), you will define and operationalize GRC frameworks that ensure alignment with industry standards such as NIST CSF 2.0, SOX ITGC, and the Trusted Partner Network (TPN) content-security standard. You will operate and mature our enterprise risk register, oversee regulatory compliance, provide independent assurance over the controls that protect Cosm's platforms and creative content, and drive the policy development that strengthens our security posture and supports business growth, including our path toward IPO readiness. As an early member of a growing InfoSec team, you will have the opportunity to shape the GRC function from the ground up, with room to grow as the team and program mature. This role is expected to build and lead the GRC function as the program scales, including hiring and developing the team that supports it. The ideal candidate brings a strong background in IT controls, audit readiness, and cross-functional collaboration, along with a passion for fostering a culture of accountability, security, and continuous improvement.

Requirements

8 to 12 years in IT governance, risk, and compliance, including leading GRC programs or major initiatives in enterprise environments
Hands-on experience operating and maturing risk registers, running risk assessments, gap analyses, and business impact analyses, and driving treatment decisions to closure
Independent control testing experience supporting SOX ITGC or pre-IPO audit readiness
Experience planning and executing internal audits
Experience owning a third-party risk program, including review of vendor security attestations
Experience running continuous-compliance and evidence collection in a GRC platform. We use Vanta
Expertise authoring IT and security policies that meet regulatory requirements, and running them through review, ratification, and acknowledgment
Track record producing board or audit-committee-level reporting on maturity, risk posture, and remediation, and designing metrics tied to risk appetite
Experience building training and awareness programs
Deep working knowledge of NIST CSF 2.0 and 800-53; familiarity with SOC 2, ISO 27001, COBIT, and CIS Controls
Ability to explain complex risk to non-technical senior stakeholders and influence decisions
Bachelor's degree in a related field, or equivalent experience
All applicants must be at least 18 years of age at the time of employment.

Responsibilities

Operate and mature the enterprise cyber risk register, from initial population to a sustained program, including the inherent and residual scoring methodology
Conduct business impact analyses to identify critical assets, systems, and processes and their tolerance for disruption, and use the results to inform asset criticality and risk prioritization
Facilitate the executive risk review cycle: surface residual risks that exceed appetite, coordinate treatment versus acceptance decisions, and track risk owners and treatment plans to closure
Maintain the risk appetite framework so that scoring, escalation thresholds, and exceeds-appetite triggers stay aligned to what the Audit Committee has approved, and support its annual review
Provide independent verification of control design and operating effectiveness for controls implemented and operated by Engineering, Security Engineering, and IT, maintaining separation between those who build and operate controls and those who assure them
Audit technical standards authored by Security Engineering, such as firewall and hardening baselines, against policy and framework requirements
Own the control evidence program: ensure each control has an assigned owner and defined evidence, that collection happens on the required cadence, and that evidence remains current and audit ready
Monitor evidence coverage and freshness across the control catalog, and drive remediation of missing, stale, or failing evidence ahead of audits
Track control deficiencies to remediation and report residual exposure to leadership
Track and ensure compliance with NIST CSF 2.0, SOX ITGC, TPN, and other applicable regulatory and contractual frameworks
Plan and execute internal audits and reviews, and perform and document control testing
Support external assessments and lead customer and partner security due diligence engagements
Own the third-party security risk program end to end: intake, security review, risk rating, and ongoing monitoring across the vendor lifecycle
Collect and review vendor and datacenter security attestations, tracking coverage and expiration
Partner with Legal and Procurement to embed security requirements into vendor onboarding and contracts
Author and maintain IT and security policies, and drive them through review, ratification, distribution, and tracked acknowledgment where they bind individuals, including contractors before access is granted
Review technical standards authored by Security Engineering for policy alignment
Manage the control catalog that maps Cosm's controls to its frameworks, and coordinate control ownership across the organization
Monitor and report on the coverage and health of the control framework as risks, business needs, and regulatory requirements evolve
Own the security awareness and role-based training program end to end: content, cadence, delivery, phishing simulation, and completion tracking
Deliver role-specific training for administrators, privileged users, and developers
Promote a culture of security and compliance across the organization
Design and maintain the cybersecurity metrics framework: KPIs that show whether controls are achieving their objectives, and KRIs that provide forward-looking risk exposure, each tied to risk appetite rather than activity volume
Define and operate the escalation triggers that force an off-cycle report to the Audit Committee, such as a critical vulnerability unremediated beyond its SLA or a control failure in a high-criticality area
Produce the quarterly Audit Committee reporting package: maturity movement with rationale, top gaps with owner and remediation date, incidents mapped to previously identified gaps, and resourcing needs tied to closing specific gaps
Present risk and compliance reporting to senior leadership, the Cybersecurity Executive Steering Committee, and the Audit Committee
Communicate risk and compliance issues clearly to both technical and non-technical stakeholders
Provide risk, control, and impact context to the decision-makers assessing whether an incident is material
Own the control and maturity findings arising from post-incident review
Build and lead the GRC function as the program scales, including hiring and developing the team that supports it