GRC Lead - CIO Enterprise Risk Management Working Group

Pueo Business Solutions LLC•McLean, VA

About The Position

Pueo is seeking a GRC Lead to provide strategic oversight and coordination for the implementation of the Defense Intelligence Agency's enterprise cybersecurity risk management framework. This role involves leading the CIO Enterprise Risk Management Working Group (CERMS WG), offering senior-level program management, governance, policy development, and stakeholder coordination to support enterprise and system-level cybersecurity risk decisions. The GRC Lead will collaborate closely with various CIO leadership offices, the Chief Risk Officer, Risk Owners, and other agency stakeholders to establish risk tolerance matrices, decision frameworks, escalation protocols, governance processes, and executive reporting mechanisms. The position is crucial for facilitating enterprise consensus on cybersecurity risk management methodologies and ensuring the agency has repeatable, defensible processes for evaluating, accepting, escalating, and communicating cybersecurity risk.

Requirements

Twelve (12) years of relevant experience in program management, risk management, cybersecurity governance, or related disciplines.
Minimum five (5) years of experience managing enterprise-level governance programs or cybersecurity risk management initiatives.
Demonstrated experience coordinating cross-directorate or cross-functional stakeholders in complex organizational environments.
Experience developing and implementing policy or governance frameworks within Government, Department of Defense, Intelligence Community, or similarly regulated environments.
Expert knowledge of cybersecurity and enterprise risk management frameworks.
Demonstrated experience facilitating senior or executive-level working groups.
Strong written and verbal communication skills with experience communicating to executive audiences.
Bachelor's degree from an accredited college or university in Business Administration, Information Systems, Cybersecurity, or a related field.

Nice To Haves

Experience supporting Intelligence Community organizations.
Experience supporting Department of Defense cybersecurity or enterprise risk management programs.
Familiarity with IC/DoD organizational structure, CIO organizations, and Agency decision-making processes.
Experience implementing or supporting Governance, Risk, and Compliance (GRC) platforms or enterprise risk management systems.
Experience establishing risk tolerance models for large portfolios of information systems and ATOs.
Experience developing cybersecurity governance processes for senior executive decision-making.
Experience leading organizational change associated with implementation of new governance or risk management frameworks.
Technical background in cybersecurity, information assurance, information systems, or related disciplines.
Project Management Professional (PMP)
Certified in Risk and Information Systems Control (CRISC)
Certified in Governance, Risk and Compliance (CGRC)
Certified Information Systems Security Professional (CISSP)
Certified Information Security Manager (CISM)
Other relevant cybersecurity, risk management, or program management certification

Responsibilities

Lead implementation and maturation of the CERMS WG Charter and associated enterprise cybersecurity risk governance framework.
Provide strategic program management and oversight for enterprise cybersecurity risk management initiatives.
Coordinate with CIO-5 Strategy & Programs Office on strategic risk management priorities and activities.
Develop and maintain comprehensive project plans, milestones, action items, and implementation schedules.
Provide recurring program status, risk, and performance reporting to CIO-4 leadership.
Coordinate stakeholder engagement across CIO organizations, SPP/DDI, Deputy Directors, J2s, Director-level leadership, and other Agency stakeholders.
Lead development of CIO-level Administrative Instructions, governance documentation, and supporting enterprise risk management policies.
Develop CIO-4 Standard Operating Procedures (SOPs) governing cybersecurity risk tolerance decisions and supporting processes.
Define and document escalation protocols, decision authorities, and organizational responsibilities for enterprise and system-level risk decisions.
Coordinate policy review, adjudication, concurrence, and approval processes across Agency stakeholders.
Guide CERMS WG meetings and facilitate executive and cross-directorate stakeholder discussions.
Establish working group agendas in coordination with the CRO, Risk Leads, and other key stakeholders.
Coordinate with CIO Risk Owners across divisions to ensure effective participation and execution of risk management activities.
Facilitate consensus on enterprise cybersecurity risk methodologies, thresholds, decision processes, and reporting requirements.
Oversee development and maintenance of enterprise risk tolerance matrices and decision-support frameworks.
Direct development and maintenance of risk management dashboards and executive reporting mechanisms.
Ensure effective configuration management, version control, storage, and accessibility of program artifacts.
Maintain or oversee meeting minutes, decision records, action tracking, and governance documentation.
Identify program risks, barriers, and competing priorities and develop strategies to maintain implementation momentum.