Senior Manager, Governance, Risk & Compliance

Andersen•Los Angeles, CA

About The Position

Andersen is scaling its information security function, and this is a critical hire for the program’s next phase of maturity. The Senior Manager, Governance Risk & Compliance (GRC) will report directly to the Chief Information Security Officer (CISO) and own the build-out of the firm’s governance, risk, and compliance program. The immediate mandate is significant – lead simultaneous SOC 2 Type II and ISO 27001 certification initiatives while establishing the policy and risk management infrastructure the firm will rely on long-term. This is a program-building role, and the right candidate will be energized by the opportunity to design systems rather than maintain them.

Requirements

8–12 years of progressive experience in information security GRC, with a demonstrated record of building programs, not just maintaining them
Bachelor’s degree in Information Security, Computer Science, Risk Analysis, or a related field
Proven track record achieving and sustaining both SOC 2 Type II and ISO 27001 certifications, including scoping, control design, ISMS development, and auditor relationship management
Operational knowledge of GDPR and CCPA, including hands-on implementation of compliance obligations
Experience designing and operating third-party risk management programs
Experience managing client security due diligence and responding to security questionnaires at scale
Ability to build defensible, auditable policy frameworks and maintain structured enterprise risk registers
Proficiency with GRC or compliance automation platforms
Strong written and verbal communication skills, with the ability to translate technical risk into business language for non-technical audiences
Understanding of the security and governance risks introduced by AI systems, including large language models, AI agents, and citizen developer platforms, and the ability to translate those risks into policy, training content, and risk register entries

Nice To Haves

Relevant certification such as CISA, CISM, or CRISC
Background in professional services or consulting, where security posture is tied directly to client trust
Familiarity with international privacy frameworks such as NDPA or DPDPA
Working knowledge of the NIST Cybersecurity Framework as a risk management overlay
Familiarity with AI governance frameworks such as NIST AI RMF, the EU AI Act, or ISO 42001, and awareness of emerging regulatory obligations affecting AI use in global professional services environments
Experience managing or mentoring junior GRC staff

Responsibilities

Lead end-to-end certification programs for SOC 2 Type II and ISO 27001 simultaneously, from scoping through audit closure
Define control environments, manage evidence collection, and serve as the primary liaison with external auditors and certification bodies
Administer the firm’s compliance automation platform and maintain continuous control monitoring and audit readiness
Manage both programs through their full lifecycle, including observation periods, annual renewals, surveillance audits, and ISO recertification cycles
Develop and maintain a comprehensive information security policy suite aligned to SOC 2, ISO 27001, and applicable regulatory requirements, with defined processes for ownership, annual review, and exception management
Build and maintain an enterprise risk register using structured methodology (e.g., ISO 27005, NIST CSF) and lead annual and ad hoc risk assessments
Communicate risk posture and policy compliance to the CISO and, where appropriate, to firm leadership and clients
Develop and maintain an AI governance policy covering acceptable use of AI tools, agentic system deployments, and citizen developer activity, ensuring alignment with the firm’s risk appetite and applicable regulatory requirements
Serve as the firm’s subject matter expert on GDPR, CCPA, and other applicable privacy and data protection requirements
Monitor evolving regulatory obligations globally and translate them into actionable compliance programs
Partner with Legal and Operations on data subject requests, privacy impact assessments, and breach notification procedures
Advise the CISO on emerging compliance obligations relevant to a global professional services firm
Design and operate the firm’s third-party risk management program, including vendor tiering, security assessments, and remediation tracking
Manage the firm’s response program for client security questionnaires and due diligence requests
Maintain a library of certification-aligned response language and track contractual security commitments across vendors and clients
Own the firm’s security awareness program, including curriculum design, platform administration, and completion tracking
Develop role-specific content for high-risk populations and keep training current against the evolving threat landscape
Develop and maintain training content addressing AI-related threats and responsible AI use, including risks from unsanctioned AI tools, citizen developer activity, and AI agents operating with access to firm data and systems
Track and report program effectiveness to the CISO on a regular cadence
Build collaborative relationships across Legal, IT, Operations, Audit, and client-facing teams to embed security and compliance into firm workflows
Represent the information security function in client-facing conversations regarding the firm’s security posture