Sr. Director, Governance, Risk, and Compliance (GRC)

Nordstrom•Seattle, WA

2d•$221,000 - $365,000

About The Position

The Senior Director of Governance, Risk, and Compliance (GRC) is a highly visible leader responsible for building and maturing a modern, enterprise-wide GRC function at Nordstrom. The role protects the company’s brand and customer, employee, and partner trust while enabling secure growth, digital transformation, operational excellence, and exceptional omni-channel customer experiences. It ensures governance, risk, and compliance operate as strategic enablers rather than barriers to progress. Working closely with the Chief Information Security Officer (CISO) and senior leaders across Technology, Legal, Finance, HR, and the business, the Senior Director translates complex cybersecurity, regulatory, and enterprise risks into actionable insights for executive decision-making. The position is based in Seattle and reports directly to the Chief Information Security Officer.

Requirements

10+ years of progressive experience in governance, risk, compliance, information security, or enterprise risk management.
5+ years of experience in senior leadership roles.
Proven success building, scaling, or transforming enterprise GRC programs in complex, regulated environments.
Strong executive presence and ability to influence senior leaders and translate risk into business-relevant outcomes.
Deep expertise across cybersecurity risk, IT risk, enterprise risk, third-party risk, and regulatory compliance frameworks.
Demonstrated experience partnering closely with a CISO and security leadership to align risk, compliance, and security strategy.
Track record of advancing compliance from point-in-time audits to continuous readiness and control optimization.
Experience developing executive-level dashboards, metrics, and reporting for senior leadership, audit committees, or Boards.
Strong cross-functional leadership skills and ability to align Legal, Technology, Finance, HR, and business teams around shared risk ownership.
Excellent written and verbal communication skills, with judgment to operate effectively in high-impact, ambiguous situations.

Nice To Haves

Familiarity with leading GRC platforms and automation tools such as ServiceNow GRC, Archer, or OneTrust.

Responsibilities

Partner with the CISO to shape and execute an enterprise-wide GRC strategy aligned with business priorities and risk appetite.
Lead governance, risk, and compliance programs that enable secure growth and maintain regulatory rigor across a complex, customer-facing organization.
Translate cybersecurity, regulatory, and enterprise risk into actionable insights for executive leadership and senior stakeholders.
Review and guide enterprise risk assessments across cyber, IT, third-party, and operational domains, ensuring risks are understood, prioritized, and actively managed.
Oversee internal and external audit activities, coordinating work, ensuring timely remediation, and maintaining continuous readiness.
Drive executive- and Board-level risk reporting through dashboards, metrics, and storytelling that inform decision-making.
Partner with Legal, Technology, Finance, HR, and business leaders to embed risk management into strategy, transformation initiatives, and vendor relationships.
Lead and develop a high-performing GRC organization, setting priorities, accountability, and operating rhythms.
Evaluate and optimize GRC tools and platforms, advancing automation and scalable risk and compliance management.
Monitor emerging regulatory requirements, industry trends, and best practices, and advise the CISO on implications and recommended actions.