Manager, Governance Risk and Compliance

Harley-Davidson•Milwaukee, WI

2d•$138,100 - $220,900•Onsite

About The Position

The Manager of Harley-Davidson, Inc’s Technology Governance, Risk and Compliance (GRC) reports to the Chief Information Security and Privacy Officer and leads Harley-Davidson’s global information risk management and IT compliance program. The GRC leader is accountable for overseeing and coordinating the IT and cybersecurity program objectives needed to achieve and maintain HDI’s compliance with regulatory requirements. The position serves as a key interface among internal and external compliance bodies, auditors, technology teams, and business functions to ensure HDI’s IT general control environment is documented and operating effectively, and that information risks are reported to management for decision-making and action when necessary.

Requirements

Typically requires a minimum of 8 years of related experience.
Subject matter expert in IT compliance and auditing frameworks, practices, policies, standards, and procedures: Sarbanes-Oxley Act of 2002 (SOX), Control Objectives for Information and Related Technologies (COBIT), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), System and Organization Controls (SOC) 1 and 2, Payment Card Industry Data Security Standard (PCI DSS)ISO 27001/2, or equivalent, Three Lines of Defense Model
Demonstrated experience working in an enterprise-level Information Security Office with global accountabilities.
Direct experience leading GRC processes with business leaders and managers.
Ability to define and establish comprehensive procedures that integrate with key business processes to ensure cybersecurity standards and best practices are part of compliance and risk management by design
Excellent communication and presentation skills with demonstrated skill in presenting complex detail around regulations clearly and to a variety of audience members
Familiarity with data flows and experience with scoping general IT controls to applicable compliance requirements.
Experience participating in or overseeing Third Party Risk Management (TPRM) programs, supplier risk assessment processes and vendor scorecards.
Proven ability to develop frameworks, strategies and roadmaps and to provide direction across all areas of accountability as well as to work closely with the Corporate Information Security Office (CISO) organization where dependencies exist
Strong leadership, organization, communication, and process management skills; ability to lead and manage high-performing teams, and an ability to develop a continuous improvement mentality in all operational activities

Nice To Haves

Bachelor's Degree in business management, information systems or a related discipline
Master's Degree in related field is Preferred
Industry-recognized certification such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), or equivalent is preferred
Experience in building and leading a team with a proven ability in developing capabilities, attracting and retaining a core team of collaborative professionals and creating an organization viewed as a highly attractive place to work.
Understanding of Payment Card Industry Data Security Standards (PCI DSS) Compliance requirements, the Attestation process, and working with business leaders to redesign business processes as needed

Responsibilities

Build and maintain strong business partnerships across key areas at a senior leadership level, bridging their understanding of GRC concepts and requirements with an understanding of regional and global business practices
Develop and implement processes to map IT general controls to established GRC standards and frameworks enabling efficient monitoring and reporting of regulatory compliance and risks.
Oversee audit testing of general IT controls, report on identified exceptions and deficiencies, guide the development of management action plans and escalate priority issues.
Manage and facilitate a secured process for all HR/Legal/Ethics IT/Security-related Investigations
Work with IT Senior Leadership to identify, assess, and bring visibility to the most significant IT security risks across the GIS organization while ensuring the appropriate resources are assigned to remediate risks.