Manager, GRC-A (Information Security Risk)

SAS•Cary, NC

15d•Hybrid

About The Position

The Manager, Governance, Risk, Compliance – Audit (GRC-A) is a hands on management role combining technical risk management expertise with people leadership, overseeing a team that evaluates information security and cybersecurity risks across SAS and our third-parties. As a working manager, the position is actively involved in risk analysis and problem-solving while also guiding program execution, stakeholder engagement, and continuous improvement efforts. The Governance, Risk, Compliance - Audit team provides independent assessment and advisory services, facilitates compliance with regulatory and security requirements, performs assurance activities, and delivers information that enables informed business and risk decisions. Through collaboration, innovation, and practical risk management, the team helps protect SAS while enabling business success.

Requirements

Bachelor's or Master’s degree in Business, IT, Cybersecurity, Project Management or related field.
Typically requires 4-8 years of demonstrated success performing risk management. Experience in a regulated (pharmaceutical, banking, insurance, government) industry (may be concurrent with the above functional experience).
Demonstrated strong management and leadership skills.
Excellent awareness of GRC tooling, such as ServiceNow IRM
Excellent ability to handle multiple projects at the same time.
Excellent ability to supervise and train employees with varying skill sets in a high-pressure environment.
Excellent verbal, written, and interpersonal skills.
Demonstrated ability to solve complex problems.
Equivalent combination of related education, training and experience may be considered in place of the above qualifications.
Deep understanding of information security risk frameworks (NIST CSF, CRI Profile, PCI DSS, CIS Controls, etc.) and enterprise risk management principles, with practical experience applying them across systems, processes, and third-party vendors.
Ability to lead projects from start to finish, working independently, escalating issues, as appropriate and being flexible, when needed.
Experience applying enterprise risk management (ERM) principles and methodologies to identify, assess, prioritize, and communicate technology, cybersecurity, operational, or third-party risks.
Ability to build strong partnerships with security and technology teams across the enterprise.

Nice To Haves

Strategic Planning -Obtains information and identifies key issues and relationships relevant to achieving a long-range goal; committing to a course of action to accomplish a long-range goal after developing alternatives based on logical assumptions, facts, available resources, constraints, and organizational values.
Leading Change -Drives organizational and cultural changes needed to achieve strategic objectives; catalyzing new approaches to improve results by transforming organizational culture, systems, or products/services; helping others overcome resistance to change
Global Perspective - Demonstrates awareness of and sensitivity to the international market, cultural, technological, political, and legal factors that impact individual and work group priorities and results; leveraging own understanding of the organization’s global strategy, global business trends, and regional differences to enhance individual and work group results.
Ability to interview and manage staff, providing appropriate training and guidance as well as ongoing performance management.
Strong management, leadership, and executive presentation skills.

Responsibilities

Lead and continuously mature the information security risk management and third-party security risk assessment programs, providing direction to team members while driving initiatives that enhance SAS's risk management program.
Partner with business, technology, and service provider stakeholders to identify, assess, monitor, and manage information security risks.
Monitor evolving regulatory and industry requirements affecting cybersecurity, technology risk, privacy, operational resilience, and third-party risk management, and incorporate applicable requirements into program practices.
Perform information security risk assessments and document threats, vulnerabilities, controls, and residual risks across internal systems, cloud services, third-party vendors, and enterprise initiatives.
Oversee risk assessment activities and risk treatment plans, ensuring clear ownership, timely remediation, and accountability for mitigation actions.
Maintain and enhance risk management methodologies, risk scoring models, governance processes, and the risk register to support consistent and effective risk decision-making.
Define, track, and communicate cybersecurity risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.
Manage the third-party security risk assessment team, providing guidance on complex assessments and ensuring cybersecurity, privacy, compliance, and operational risks are consistently identified, evaluated, reported, and managed.
Collaborate with Procurement, Legal, and Third-Party Risk Management (TPRM) stakeholders to integrate security and compliance requirements throughout vendor onboarding, contracting, and ongoing oversight processes.
Define, track, and communicate third-party security risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.

Benefits

Comprehensive medical, prescription, dental and vision plans.
PPO with low annual deductible and copays.
HDHP combined with a health savings account with a contribution from SAS (no access to on-site health care center).
Onsite Health Care Center (HQ) that’s free to employees and family members enrolled in the PPO plan.
Pharmacy available.
An industry-leading 401k plan.
Tuition Assistance Program and programs and resources to support your development
Generous time away including vacation time, a variety of paid holidays, and our much-loved U.S. Winter Wellness Break between December 25 and January 1.
Volunteer Time Off, parental leave and unlimited paid sick days.
Generous childcare benefits for all full-time employees.