Governance, Risk & Compliance Manager

VIAVI Solutions•Chandler, AZ

About The Position

VIAVI Solutions is seeking a Manager, Governance, Risk & Compliance (GRC) to lead and mature the company's information security governance, cybersecurity risk, compliance and assurance capabilities. This is a hands-on player-coach role: the manager will lead the GRC function and directly perform risk assessments, policy development, control assessments, audit preparation, compliance activities, evidence reviews and remediation. The manager will have key responsibility for VIAVI's ISO 27001, CMMC and AI Governance programs, partnering with Security Engineering, Cyber Defense, Product Security, IT, Legal, Privacy, Internal Audit and business teams. The role will establish a scalable, risk-based governance model that translates regulatory, contractual and business requirements into clear security expectations, accountable ownership and measurable outcomes. The position requires use of information subject to ITAR. Applicants must be U.S. Persons as defined by ITAR: a U.S. Citizen or National, U.S. Lawful Permanent Resident, Political Asylee, Refugee, or Temporary Resident granted amnesty.

Requirements

10+ years of progressive experience in cybersecurity, information security governance, risk management, compliance, audit or security assurance.
Significant hands-on experience with cybersecurity governance and risk-management activities.
Demonstrated experience leading or materially contributing to major cybersecurity compliance, audit or assurance programs.
Experience developing policies, performing risk assessments, evaluating controls, reviewing evidence and managing remediation.
Strong understanding of common cybersecurity frameworks and control concepts.
Experience translating regulatory, contractual and risk requirements into practical control requirements.
Experience collaborating across technical, Legal, Privacy, Audit and business stakeholders.
Strong written and verbal communication skills, including the ability to communicate cybersecurity risk to leadership.
Demonstrated leadership, stakeholder-management and mentoring capabilities.
Experience with AI governance, AI risk management or emerging technology governance.
Experience implementing and maintaining tools such as Vanta, Drata or Sprinto.
Familiarity with Third-Party Vendor Risk Management processes.
Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
Familiarity with managing a Security Awareness Program, including tools such as KnowBe4 or Adaptive Security.
Must be a U.S. Person within the meaning of ITAR.

Nice To Haves

Experience leading or operating an ISO 27001 ISMS.
Experience with CMMC and/or NIST SP 800-171.
Experience with cybersecurity regulatory or customer assurance requirements.
Familiarity with NIST AI RMF, ISO/IEC 42001 or similar AI governance frameworks.
Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor or comparable credentials.
Previous people-management or GRC team-leadership experience.

Responsibilities

Develop, maintain and continuously improve the enterprise information security governance framework.
Develop and maintain security policies, standards, procedures and supporting governance documentation.
Establish clear security-control ownership and accountability across the organization.
Maintain security exception, risk-acceptance and waiver processes.
Translate regulatory, contractual and business requirements into practical security requirements and promote consistent, sustainable security practices.
Develop and operate cybersecurity risk-management processes and methodologies.
Lead risk assessments for significant technologies, business initiatives, third parties and changes to the technology environment.
Maintain visibility into significant cybersecurity risks, owners, treatment plans, exceptions and residual risks.
Facilitate risk-treatment and risk-acceptance decisions with business and technology stakeholders.
Develop cybersecurity risk reporting for security leadership and executive stakeholders.
Lead the ongoing management and continuous improvement of VIAVI's Information Security Management System (ISMS).
Coordinate ISO 27001 risk assessments, control reviews, internal assessments, corrective actions and certification or surveillance readiness.
Lead GRC activities supporting CMMC readiness and ongoing compliance, including scoping, control ownership, documentation, evidence and assessment preparation.
Partner with technical and business control owners to identify and remediate security-control gaps and establish sustainable evidence-management and control-validation practices.
Develop and mature the enterprise AI governance and risk-management framework, including requirements for responsible and secure AI adoption.
Develop an AI risk-tiering approach and governance processes for assessing and approving AI tools, applications and use cases.
Define AI-related exception and risk-acceptance processes, and establish governance expectations for sensitive-data use and human oversight of higher-risk AI applications.
Partner with Security Engineering to translate AI governance requirements into technical controls and guardrails, and work with Legal, Privacy, Procurement, IT and business stakeholders on AI risks and requirements.
Monitor relevant AI standards and regulatory developments and incorporate applicable requirements into the governance program; support alignment with NIST AI RMF and ISO/IEC 42001 as appropriate.
Coordinate cybersecurity-related internal and external assessments and audits.
Evaluate control implementation and supporting evidence against defined requirements.
Coordinate remediation with control owners and monitor significant security and compliance gaps.
Partner with Legal, Privacy, Internal Audit, Security and technology teams on overlapping regulatory and assurance requirements.
Support customer or third-party cybersecurity assurance activities as appropriate.
Personally perform critical GRC work while developing the broader capability; mentor team members and establish repeatable, sustainable GRC processes.