Lead Information Security Auditor (GRC)

CONMED Corporation • Largo, FL

1d • $104,134 - $163,640 • Remote

About The Position

The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization’s cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology (OT), and enterprise IT environments. This remote role ensures that cyber risk is effectively managed, applicable regulatory and industry requirements are met, and governance processes protect intellectual property, patient safety, operational resilience, and business objectives.

The position serves as a key liaison among cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators. It helps embed security requirements throughout the organization’s operations and product lifecycle, enabling secure innovation, regulatory readiness, enterprise cyber risk management, and executive visibility into cybersecurity posture and compliance performance.

The role leads governance and risk programs, regulatory compliance and audit activities, third-party risk management, product security governance, awareness initiatives, and business continuity and resilience governance. It also provides leadership and direction for GRC initiatives, mentors cybersecurity professionals, and supports strategic cybersecurity planning and roadmap development.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or a related field.
• At least 7 years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.
• Certified Information Systems Auditor (CISA) certification.

Nice To Haves

• Experience developing and managing cybersecurity governance, risk, and compliance programs.
• Experience conducting risk assessments and managing enterprise risk registers.
• Experience supporting internal audits, external audits, and regulatory examinations.
• Strong understanding of cybersecurity frameworks and regulatory requirements.
• Experience in healthcare, medical device manufacturing, life sciences, or other regulated industries.
• Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.
• Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.
• Experience developing executive risk reporting, metrics, and board-level presentations.
• Familiarity with medical device cybersecurity regulations and product security risk management.
• Preferred certifications: CISSP, CRISC, CISM, CGRC (formerly CAP), or ISO 27001 Lead Implementer or Lead Auditor.

Responsibilities

• Develop, implement, and maintain cybersecurity policies, standards, procedures, and governance frameworks.
• Align cybersecurity initiatives and framework activities with business objectives and regulatory requirements, including NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, and NIS2.
• Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership; facilitate steering committees and governance forums.
• Track remediation and risk mitigation activities and ensure accountability.
• Lead enterprise-wide cybersecurity risk assessments and risk management programs, maintaining a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
• Evaluate risks related to patient safety, operational resilience, intellectual property, regulatory exposure, and business continuity.
• Assess risks associated with new technologies, business initiatives, mergers, acquisitions, and strategic projects; develop risk treatment plans and monitor mitigation through completion.
• Translate technical security risks into business impact statements for executive leadership.
• Lead cybersecurity compliance efforts and coordinate internal and external audits, regulatory inspections, and customer security assessments.
• Manage audit evidence collection, control validation, remediation tracking, control maturity assessments, and framework gap analyses.
• Partner with Internal Audit, Legal, Compliance, and Regulatory Affairs to maintain compliance readiness; oversee audit findings and corrective action plans through closure.
• Lead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers.
• Establish third-party security requirements and contractual obligations, evaluate supplier security posture, and monitor compliance.
• Drive remediation and risk acceptance processes for supplier risks.
• Partner with Engineering, Product Development, Quality, and Regulatory Affairs to incorporate cybersecurity requirements throughout the product lifecycle.
• Oversee cybersecurity risk assessments for medical and surgical devices and support secure development governance and cybersecurity documentation.
• Ensure compliance with applicable device cybersecurity guidance and regulatory expectations; facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.
• Lead enterprise cybersecurity awareness, education, and compliance initiatives, promoting security accountability and risk ownership.
• Develop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams; support phishing awareness, policy compliance, and security training.
• Measure and report on security awareness program effectiveness and compliance trends.
• Partner with business continuity and disaster recovery stakeholders on cyber resilience requirements, business impact analyses, and resilience planning.
• Participate in tabletop exercises and cyber crisis management planning; evaluate recovery capabilities and resilience controls for critical processes and manufacturing operations.
• Monitor remediation actions resulting from exercises and resilience assessments.
• Provide leadership and direction for cybersecurity GRC initiatives and mentor cybersecurity professionals on risk management, compliance frameworks, and governance practices.
• Serve as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs.
• Present risk and compliance updates to executive leadership, committees, and external stakeholders, and support strategic cybersecurity planning and roadmap development.

Benefits

• Competitive compensation.
• Medical, dental, vision, and prescription coverage.
• Short- and long-term disability and life insurance, fully paid by CONMED.
• Retirement Savings Plan (401(k)) with dollar-for-dollar contribution matching and potential matching up to 7% per pay period.
• Employee Stock Purchase Plan with discounted stock purchases.
• Tuition assistance for undergraduate and graduate courses.
• Employee Referral Program incentives for eligible referrals.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior