Head of Cybersecurity Governance, Risk & Compliance

CRC Group • Charlotte, NC

7d • Hybrid

About The Position

This role is for the Head of Cybersecurity Governance, Risk & Compliance (GRC) function within a nationally recognized insurance wholesale brokerage organization. The Cyber GRC program was built from the ground up and is now moving into a more mature, business-as-usual operating model, delivered by a hybrid team of full-time employees and strategic contract support spanning regulatory compliance, IT and cyber risk, third-party risk, AI governance, education and awareness, policy and standards, and disaster recovery governance.

As Head of Cyber GRC, this leader will carry the program forward, owning critical governance across Cyber risk, IT risk, regulatory compliance, Third-Party Vendor risk, AI governance, and disaster recovery governance. The role ensures cybersecurity, technology, and regulatory risks are identified, documented, escalated, remediated, and communicated effectively across the enterprise, and is central to translating complex risk and compliance topics into clear, business-ready language for senior leadership.

The position offers broad ownership and enterprise visibility, with high-trust partnership across the CISO, CIO, Legal, Privacy, Compliance, Enterprise Risk, Supplier Risk, Internal Audit, IT, Cybersecurity, and business leaders. It also provides exposure to a unique Cybersecurity regulatory environment, including Committee on Foreign Investment in United States (CFIUS)-related obligations, NYDFS cybersecurity compliance, and insurance-sector governance requirements.

Requirements

• Senior cybersecurity GRC, technology risk, cyber risk, information security governance, or regulatory compliance leadership experience
• Background in insurance, financial services, banking, brokerage, or another highly regulated enterprise environment
• Prior experience working directly with a CISO, CIO, or senior information security executive
• Strong understanding of cyber governance, IT and cyber risk registers, regulatory compliance, control environments, audit readiness, and remediation tracking
• Experience with third-party cyber risk, vendor due diligence, supplier risk partnership, and customer/carrier audit response
• Experience with GRC platforms such as AuditBoard/Optro, Archer, ServiceNow IRM/GRC, MetricStream, LogicGate, OneTrust, or similar tools
• Strong executive communication skills, with the ability to simplify complex cyber, technology, regulatory, and operational risk topics for senior leadership
• Ability to lead emerging technology governance, particularly AI governance, policy, standards, risk review, and control development
• Ability to manage executive stakeholders while providing the team clear direction, prioritization, and support
• Proven ability to ensure cybersecurity, technology, and regulatory risks are identified, documented, escalated, remediated, and communicated across the enterprise

Nice To Haves

• Certifications such as CISM, CISSP, CRISC, CISA, GSLC, or similar are preferred
• NYDFS cybersecurity experience is strongly preferred
• CFIUS experience is highly valuable

Responsibilities

• Serve as a hands-on, working leader who personally performs and owns key GRC deliverables — risk assessments, control reviews, regulatory analysis, and reporting — while leading the function across regulatory compliance, technology risk, cyber risk, third-party risk, AI governance, awareness, and policy and standards
• Manage key regulatory obligations tied to CFIUS, including national security agreement and data security plan commitments
• Support NYDFS cybersecurity compliance in partnership with internal subject matter experts and broader risk and compliance stakeholders
• Oversee IT and cyber risk registers, risk assessments, remediation tracking, findings management, and governance reporting through Optro (formerly AuditBoard)
• Lead third-party cyber risk management, including vendor due diligence, supplier risk partnership, SOC/SIG review, and cyber-related audit response
• Govern the AI risk management framework, including policy, standards, council activity, risk review, and governance maturity
• Manage and maintain a technology control library to support clear ownership and accountability and to report on the effectiveness of NIST-aligned controls across the organization
• Oversee cybersecurity education, awareness, communications, phishing simulations, testing, metrics, and reporting
• Provide governance oversight for disaster recovery, including plan readiness, testing expectations, and accountability tracking
• Partner across Legal, Privacy, Compliance, Enterprise Risk, Internal Audit, IT, Cybersecurity, Supplier Risk, and business leadership to drive practical risk management

Benefits

• medical, dental, vision, life, disability, and AD&D insurance
• tax-advantaged savings accounts
• a 401(k) plan with company match
• generous paid time off programs, including company holidays, vacation and sick days, new parent leave, and more
• restricted stock units
• a deferred compensation plan

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed