Lead Information Security Auditor (GRC)

CONMED Corporation • Largo, FL

5d • $104,134 - $163,640

About The Position

The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization's cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology, and enterprise IT environments. The role ensures effective cyber risk management, compliance with applicable regulatory and industry requirements, and governance processes that protect intellectual property, patient safety, operational resilience, and business objectives. It serves as a key liaison among cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators, and helps embed security requirements throughout operations and the product lifecycle.

The position supports secure innovation, regulatory readiness, enterprise cyber risk management, and executive visibility into cybersecurity posture and compliance performance. It leads governance, risk assessment, regulatory compliance and audit management, third-party risk management, product security governance, security awareness, and business continuity and resilience governance. The role also provides leadership and direction for GRC initiatives, mentors cybersecurity professionals, and supports strategic cybersecurity planning and roadmap development.

The annual salary range is $104,134–$163,640. Actual compensation may vary based on geographic location, work experience, education, and skill level. The posting is anticipated to close November 8, 2026, though the period may be extended. This position is not eligible for employer-visa sponsorship.

Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or a related field, or equivalent experience.
• At least 7 years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.

Nice To Haves

• Experience developing and managing cybersecurity governance, risk, and compliance programs.
• Experience conducting risk assessments and managing enterprise risk registers.
• Experience supporting internal audits, external audits, and regulatory examinations.
• Strong understanding of cybersecurity frameworks and regulatory requirements.
• Experience in healthcare, medical device manufacturing, life sciences, or other regulated industries.
• Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.
• Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.
• Experience developing executive risk reporting, metrics, and board-level presentations.
• Familiarity with medical device cybersecurity regulations and product security risk management.
• Preferred professional certifications: CISSP, CRISC, CISM, CGRC (formerly CAP), CISA, or ISO 27001 Lead Implementer or Lead Auditor.

Responsibilities

• Lead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.
• Establish governance processes that align cybersecurity initiatives with business objectives and regulatory requirements.
• Maintain framework alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.
• Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.
• Facilitate cybersecurity steering committees and governance forums with senior stakeholders.
• Track remediation activities and ensure accountability for risk mitigation.
• Lead enterprise-wide cybersecurity risk assessment and risk management programs.
• Establish and maintain a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
• Evaluate risks relating to patient safety, operational resilience, intellectual property protection, regulatory exposure, and business continuity.
• Perform risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.
• Develop risk treatment plans and monitor mitigation efforts through completion.
• Translate technical security risks into business impact statements for executive leadership.
• Lead cybersecurity compliance efforts supporting SOX, ISO 27001, NIST, GDPR, NIS2, and applicable healthcare and manufacturing requirements.
• Coordinate internal audits, external audits, regulatory inspections, and customer security assessments.
• Manage evidence collection, control validation, and remediation tracking.
• Conduct control maturity assessments and gap analyses against regulatory and industry frameworks.
• Partner with Internal Audit, Legal, Compliance, and Regulatory Affairs to maintain compliance readiness.
• Oversee audit findings and corrective action plans through closure.
• Lead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers.
• Establish third-party security requirements and contractual security obligations.
• Evaluate supplier security posture and monitor compliance with organizational requirements.
• Assess third-party risks affecting manufacturing operations, product development, cloud services, and intellectual property.
• Drive remediation and risk acceptance processes for identified supplier risks.
• Partner with Engineering, Product Development, Quality, and Regulatory Affairs to incorporate cybersecurity requirements throughout the product lifecycle.
• Oversee cybersecurity risk assessments for medical and surgical devices.
• Support secure development governance processes and cybersecurity documentation requirements.
• Ensure compliance with applicable device cybersecurity guidance and regulatory expectations.
• Facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.
• Lead enterprise cybersecurity awareness, education, and compliance initiatives.
• Promote a culture of security accountability and risk ownership throughout the organization.
• Develop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams.
• Support phishing awareness, policy compliance, and security training programs.
• Measure and report on program effectiveness and compliance trends.
• Partner with business continuity and disaster recovery stakeholders to address cyber resilience requirements.
• Support business impact analyses and resilience planning activities.
• Participate in tabletop exercises and cyber crisis management planning.
• Evaluate recovery capabilities and resilience controls for critical business processes and manufacturing operations.
• Monitor remediation actions resulting from exercises and resilience assessments.
• Provide leadership and direction for cybersecurity governance, risk, and compliance initiatives.
• Mentor cybersecurity professionals on risk management, compliance frameworks, and governance best practices.
• Serve as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs functions.
• Present risk and compliance updates to executive leadership, committees, and external stakeholders.
• Support strategic cybersecurity planning and roadmap development.

Benefits

• Competitive compensation
• Medical, dental, vision, and prescription coverage
• Short- and long-term disability insurance and life insurance, with costs fully paid by CONMED
• Retirement Savings Plan (401(k)) with dollar-for-dollar matching and potential matching of up to 7% per pay period
• Employee Stock Purchase Plan with discounted stock purchases
• Tuition assistance for undergraduate and graduate-level courses
• Employee Referral Program incentives

What This Job Offers

• Job Type: Full-time
• Career Level: Senior