Governance, Risk & Compliance Manager

Viavi Solutions•Chandler, AZ

11h

About The Position

VIAVI Solutions is seeking a Manager, Governance, Risk & Compliance (GRC) to lead and mature the company's information security governance, cybersecurity risk, compliance and assurance capabilities. This is a player-coach role with a strong hands-on expectation: the successful candidate will lead the GRC function while directly performing risk assessments, policy development, control assessments, audit preparation, compliance activities, evidence reviews and remediation. The role has key responsibility for VIAVI's ISO 27001, CMMC and AI Governance programs. The Manager partners across Security Engineering, Cyber Defense, Product Security, IT, Legal, Privacy, Internal Audit and business teams to establish a scalable, risk-based governance model that turns regulatory, contractual and business requirements into clear security expectations, accountable ownership and measurable outcomes.

Requirements

10+ years of progressive experience in cybersecurity, information security governance, risk management, compliance, audit or security assurance.
Significant hands-on experience with cybersecurity governance and risk-management activities.
Demonstrated experience leading or materially contributing to major cybersecurity compliance, audit or assurance programs.
Experience developing policies, performing risk assessments, evaluating controls, reviewing evidence and managing remediation.
Strong understanding of common cybersecurity frameworks and control concepts.
Experience translating regulatory, contractual and risk requirements into practical control requirements.
Experience working collaboratively across technical, Legal, Privacy, Audit and business stakeholders.
Strong written and verbal communication skills, including the ability to communicate cybersecurity risk to leadership.
Demonstrated leadership, stakeholder-management and mentoring capabilities.
Experience with AI governance, AI risk management or emerging technology governance.
Experience implementing and maintaining tools such as Vanta, Drata or Sprinto.
Familiarity with third-party vendor risk-management processes.
Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
Familiarity with managing a security awareness program, including tools such as KnowBe4 or Adaptive Security.
Must be a U.S. Person within the meaning of ITAR: a U.S. Citizen or National, U.S. Lawful Permanent Resident, Political Asylee, Refugee, or Temporary Resident granted amnesty.

Nice To Haves

Experience leading or operating an ISO 27001 ISMS.
Experience with CMMC and/or NIST SP 800-171.
Experience with cybersecurity regulatory or customer assurance requirements.
Experience with AI governance, AI risk management or emerging technology governance.
Experience implementing and maintaining tools such as Vanta, Drata or Sprinto.
Familiarity with third-party vendor risk-management processes.
Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
Familiarity with NIST AI RMF, ISO/IEC 42001 or similar AI governance frameworks.
Familiarity with managing a security awareness program, including tools such as KnowBe4 or Adaptive Security.
Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor or comparable credentials.
Previous people-management or GRC team-leadership experience.

Responsibilities

Develop, maintain and continuously improve the enterprise information security governance framework.
Develop and maintain security policies, standards, procedures and supporting governance documentation.
Establish clear security-control ownership and accountability across the organization.
Maintain security exception, risk-acceptance and waiver processes.
Translate regulatory, contractual and business requirements into practical security requirements and promote consistent, sustainable security practices.
Develop and operate cybersecurity risk-management processes and methodologies.
Lead risk assessments for significant technologies, business initiatives, third parties and changes to the technology environment.
Maintain visibility into significant cybersecurity risks, owners, treatment plans, exceptions and residual risks.
Facilitate risk-treatment and risk-acceptance decisions with business and technology stakeholders.
Develop cybersecurity risk reporting for security leadership and executive stakeholders.
Lead the ongoing management and continuous improvement of VIAVI's Information Security Management System (ISMS).
Coordinate ISO 27001 risk assessments, control reviews, internal assessments, corrective actions and certification or surveillance readiness.
Lead GRC activities supporting CMMC readiness and ongoing compliance, including scoping, control ownership, documentation, evidence and assessment preparation.
Partner with technical and business control owners to identify and remediate security-control gaps.
Establish sustainable evidence-management and control-validation practices.
Develop and mature VIAVI's enterprise AI governance and risk-management framework, including requirements for responsible and secure AI adoption.
Develop an AI risk-tiering approach that considers data sensitivity, autonomy, technology risk and business impact.
Establish processes for assessing and approving AI tools, applications and use cases, as well as AI-related exceptions and risk acceptance.
Set governance expectations for sensitive-data use and human oversight of higher-risk AI applications.
Partner with Security Engineering to translate AI governance requirements into technical controls and guardrails.
Partner with Legal, Privacy, Procurement, IT and business stakeholders on AI-related risk and governance requirements.
Monitor relevant AI standards and regulatory developments and incorporate applicable requirements into VIAVI's governance program.
Support alignment, as appropriate, with frameworks such as NIST AI RMF and ISO/IEC 42001.
Coordinate cybersecurity-related internal and external assessments and audits.
Evaluate control implementation and supporting evidence against defined requirements.
Coordinate remediation with control owners and monitor significant security and compliance gaps.
Partner with Legal, Privacy, Internal Audit, Security and technology teams on overlapping regulatory and assurance requirements.
Support customer or third-party cybersecurity assurance activities as appropriate.
Personally perform critical GRC work while developing the broader capability, mentoring team members and establishing repeatable, sustainable GRC processes.