Director of Governance, Risk & Compliance (Remote US)

Atmosera

6d • Remote

About The Position

The Director of Governance, Risk & Compliance (GRC) leads Atmosera's internal GRC program and Managed Governance, Risk & Compliance (MGRC) services. This is a hands-on leadership role responsible for GRC program strategy, service delivery, team leadership, client engagements, and continuous improvement. The Director will establish scalable GRC processes while directly supporting complex client and internal compliance initiatives. A key responsibility is hands-on management of federal security programs, including System Security Plans (SSPs), control implementation statements, evidence, POA&Ms, remediation activities, and responses to government and assessor findings. The ideal candidate can operate at both the executive and practitioner levels, working effectively with CISOs and auditors while also working directly with engineers and control owners to validate how security controls are implemented.

Requirements

• 8+ years of cybersecurity, GRC, security assessment, audit, or related experience.
• Demonstrated experience leading GRC programs or teams.
• Hands-on experience with NIST SP 800-53, System Security Plans, POA&Ms, control implementation statements, and federal security requirements.
• Experience managing audits, evidence, risk assessments, control gaps, policies, and remediation programs.
• Ability to translate regulatory requirements into technical and operational security controls.
• Strong client-facing, executive communication, and technical stakeholder management skills.

Nice To Haves

• Experience in an MSSP, MSP, consulting, professional services, federal program, or government contractor environment.
• Microsoft Azure and Microsoft 365 security experience strongly preferred.
• CISSP, CISM, CRISC, CISA, CGEIT, or similar certifications.

Responsibilities

• Own Atmosera's internal GRC program and operational delivery of MGRC services.
• Establish standardized methodologies, processes, templates, evidence requirements, and quality controls.
• Lead risk assessments, control assessments, compliance readiness, policy governance, Managed Audit, Managed Questionnaires, and other GRC engagements.
• Manage client commitments, priorities, capacity, deliverable quality, and service performance.
• Identify opportunities for automation and AI to improve GRC delivery and scalability.
• Partner with Sales and Client Success on service scoping, SOWs, pricing, and complex opportunities.
• Lead and maintain System Security Plans for federal clients.
• Develop and review control implementation statements and supporting evidence.
• Coordinate with technical control owners to validate how controls are implemented.
• Manage POA&Ms, control deficiencies, remediation activities, milestones, and dependencies.
• Coordinate responses to government, assessor, and auditor findings and requests.
• Facilitate SSP and control working sessions with clients, engineers, security teams, and other stakeholders.
• Support continuous monitoring, security assessments, and authorization activities.
• Maintain alignment between documented controls and the actual operating environment.
• Support requirements involving NIST SP 800-53, NIST SP 800-171, FISMA, CMMC, FedRAMP concepts, and agency-specific requirements.
• Lead cybersecurity risk assessments, control gap assessments, risk registers, treatment plans, exceptions, and remediation tracking.
• Support frameworks including SOC 2, NIST, CIS, ISO 27001, PCI DSS, HIPAA, CMMC, and Microsoft security benchmarks.
• Own Atmosera's Managed Audit methodology, including audit readiness, evidence management, auditor coordination, findings, and remediation.
• Oversee Managed Security Questionnaire delivery and development of reusable response and evidence libraries.
• Ensure policies, standards, procedures, and control documentation accurately reflect operational practices.
• Partner with the CISO to operate and mature Atmosera's internal security and compliance program, including: SOC 2 Type 2, Risk and control assessments, Policy and control governance, Audit coordination, Security questionnaires, Third-party risk, Customer security reviews, Evidence and remediation management.
• Serve as a senior GRC advisor to client security, IT, risk, compliance, and executive leadership.
• Translate regulatory and compliance requirements into actionable security improvements.
• Partner with Security Operations, Managed Azure, Microsoft 365, and engineering teams to map control requirements to technical implementations.
• Maintain working knowledge of Microsoft security technologies including Azure, Entra ID, Defender, Sentinel, Intune, Purview, and Azure Policy.
• Support vCISO engagements where governance, risk, audit, or compliance expertise is required.
• Lead, mentor, and develop GRC Analysts and Consultants.
• Manage workload, capacity, priorities, quality assurance, and escalations.
• Build repeatable processes that allow the GRC practice to scale without depending on the Director for every engagement.

Benefits

• Competitive Salary
• Generous 401(k) Plan with 100% company match on contributions up to 4% of salary
• Performance-Based Compensation with bonus potential
• 100% Employer-Paid Health, Vision, and Dental Insurance for employees
• Company-Paid Life, AD&D, Short and Long-Term Disability Insurance
• Generous Paid Time Off (PTO) - three weeks
• 11 Paid Holidays
• Community Service Leave
• Employee Recognition and Reward Program

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed