Governance, Risk, and Compliance (GRC) Program Manager

RevSpring•Phoenix, AZ

About The Position

The GRC Program Manager safeguards the organization’s reputation and supports operational excellence by developing and implementing a comprehensive governance, risk, and compliance framework aligned with industry best practices and regulatory requirements. The role develops and maintains governance policies, procedures, and standards; supports corporate governance activities; and promotes communication and collaboration across departments and stakeholders. The position identifies, assesses, and prioritizes organizational risks; develops mitigation strategies; monitors key risk indicators; and conducts risk assessments and audits. It also manages compliance programs, monitors compliance performance, and conducts internal audits and investigations to identify gaps. The manager implements and maintains a GRC framework such as NIST or HITRUST, uses GRC tools to automate processes, and maintains a dashboard of metrics and performance indicators. The role also develops and implements an incident response plan, participates in incidents and breaches, and conducts post-incident reviews. A bachelor’s degree in a relevant field and at least five years of experience in GRC, risk management, or compliance are required. A certification in GRC or a related field is noted, with HITRUST preferred. The position requires the ability to perform the described physical functions, with reasonable accommodations available for individuals with disabilities.

Requirements

Strong understanding of governance, risk, and compliance principles and frameworks.
Experience developing and implementing GRC programs.
Knowledge of relevant laws, regulations, and industry standards.
Strong analytical and problem-solving skills.
Excellent communication and interpersonal skills.
Ability to work independently and as part of a team.
Strong project management skills.
Bachelor’s degree in a relevant field, such as business, finance, information technology, or law.
At least 5 years of experience in GRC, risk management, or compliance roles.
Ability to read, analyze, and interpret business periodicals, professional journals, technical procedures, and governmental regulations.
Ability to write reports, business correspondence, and procedure manuals.
Ability to present information effectively and respond to questions from internal and external sources.
Regularly sit; use hands to finger, handle, or feel; reach with hands and arms; and talk or hear. Occasionally stand and walk, and occasionally lift or move up to 10 pounds.
Required vision abilities include close, distance, color, and peripheral vision, depth perception, and the ability to adjust focus.

Nice To Haves

Certification in GRC or a related field, such as CISA, NIST, HITRUST, or PCI; HITRUST is preferred.

Responsibilities

Develop and maintain a governance framework, including policies, procedures, and standards.
Assist with corporate governance activities, including board meetings and shareholder communications.
Support effective communication and collaboration among departments and stakeholders.
Identify, assess, and prioritize organizational risks.
Develop and implement risk mitigation strategies.
Monitor and report on key risk indicators.
Conduct regular risk assessments and audits.
Ensure compliance with applicable laws, regulations, and industry standards.
Develop and implement compliance programs and policies.
Monitor and report on compliance performance.
Conduct internal audits and investigations to identify compliance gaps.
Implement and manage a GRC framework, such as NIST or HITRUST.
Use GRC tools and technologies to automate processes and improve efficiency.
Develop and maintain a GRC dashboard to track key metrics and performance indicators.
Develop and implement an incident response plan.
Participate in incidents and breaches.
Conduct post-incident reviews and document lessons learned.