GRC Program Manager - Remote

Velera

4d•$110,100 - $143,100•Remote

About The Position

The GRC (Governance, Risk, & Compliance) Program Manager plays a critical role in ensuring the company adheres to applicable cyber laws, regulations, and information security policies and standards. The individual will design, implement, and govern cyber risk management and technology compliance activities, collectively as a program. The individual will be responsible for the implementation and optimization of a governance, risk and compliance tool with execution of one or more cyber risk management programs, to include user attestations, third-party risk management, cyber contract administration, IT control testing, and audit coordination. Program functions and duties may include: planning, scheduling, and oversight of internal/external system user attestations across the enterprise; assessing and consulting on third-party cyber risks; review and negotiation of cyber contracts; coordination of IT components of onsite and virtual audits/assessments (e.g., SOC1/2, PCI DSS/NIST CSF, NIST AI RMF), NCUA regulatory examinations and client due diligence reviews. The individual must scope and execute program(s) to ensure the organization meets regulatory requirements and industry standards to mitigate cyber risks and achieve company certification and reporting objectives (e.g., PCI DSS, NIST, SOC1/2). This is an individual contributor role reporting to the VP of Technology Compliance and engaging with internal and external stakeholders to mitigate risk, integrate security measures into business operations, and foster a security-conscious culture.

Requirements

Eight (8) years of relevant experience in cyber GRC, technology controls consulting, PCI/NIST CSF assessments, IT internal/external auditing, or cyber risk management.
At least five (5) years in a GRC program manager or equivalent role identifying, assessing, and mitigating information security, technology compliance, and cyber risks.
Implementation of GRC tool (Optro, Vanta, Drata, OneTrust) and control automation required
Experience in Financial Services, Fintech, SaaS environments highly preferred.

Responsibilities

Define program goals, measurable objectives and governance framework
Design, scope, and execute program(s) to achieve stated objectives in alignment with business strategies and priorities
Perform program functions and duties that may include: planning, scheduling, and oversight of internal/external system user attestations across the enterprise; assessing and consulting on third-party cyber risks; review and negotiation of cyber contracts; coordination of IT components of onsite and virtual audits/assessments (e.g., SOC1/2, PCI DSS/NIST CSF), NCUA regulatory examinations and client due diligence reviews.
Implement and execute assigned program(s) through the use of a GRC tool and in accordance with company reporting and certification deadlines (e.g., PCI DSS, NIST CSF, SOC1/2)
Gain support and buy-in by educating employees about program objectives, controls, and their responsibilities in mitigating cyber risks
Lead and manage cyber risk management and technology compliance initiatives
Interpret and translate cybersecurity and compliance requirements into program design
Proactively identify and monitor emerging cybersecurity threats and regulatory landscape; adapt program design, scope, and execution to mitigate risks and comply with new regulation
Collaborate and partner with cross-functional business and technology stakeholders at all levels to ensure program objectives are met; work with internal/external auditors, vendors, and clients as required
Monitor and assess program governance and effectiveness (e.g., QA reviews, control testing)
Define and report on KPIs
Identify and implement process improvements to drive program efficiencies, minimize impact to business operations, and enhance user experiences; incorporate Inspired Service elements into program design where possible
Perform all other duties as assigned.