Senior Manager GRC

Papa Johns•Louisville, KY

About The Position

Papa Johns is seeking a Senior Manager, Governance, Risk & Compliance to establish and operate the cybersecurity governance and risk control plane across the enterprise. This role is responsible for enabling risk-informed decision making, clear accountability, and consistent control governance across business, IT, cloud, and third-party environments. The ideal candidate will bring strong judgment, the ability to operate across organizational boundaries, and experience building and scaling GRC capabilities in complex environments.

Requirements

6–10+ years of experience in cybersecurity risk management
Proven leadership experience in building, scaling, and maturing teams and operating models
Strong understanding of cybersecurity control frameworks
Demonstrated ability to translate technical risk into business impact and action
Experience building or maturing GRC programs in complex organizations
Strong judgment in prioritization, tradeoff decisions, and stakeholder alignment
Experience supporting or leading SOX ITGC and/or application control environments in a complex organization
Experience establishing or evolving security awareness and behavior change programs
Excellent communication skills and ability to influence across technical and business stakeholders
Experience working with third-party risk, audit, and compliance functions

Responsibilities

Establishing and operating the enterprise cybersecurity risk management program, including risk identification, prioritization, and tracking
Defining and enforcing risk acceptance, escalation, and accountability frameworks
Developing executive and board-level risk reporting aligned to business impact
Defining and governing cybersecurity policies, standards, and control frameworks aligned to industry standard frameworks
Ensuring consistent control implementation and enforcement across IT, cloud, and business environments
Leading exception management processes to ensure risk is explicitly understood and accepted at the right levels
Establishing and leading the third-party risk management program, including vendor tiering and assessments
Coordinating regulatory and audit engagements (internal and external)
Partnering across Security, IT, Legal, Compliance, and Procurement (among others as relevant) to align risk and control expectations
Establishing and governing the cybersecurity awareness and training program, ensuring it is aligned to enterprise risk and tailored user roles
Overseeing control validation, testing, and assurance activities
Ensuring governance of vulnerability management, logging, and detection capabilities
Driving continuous improvement through risk insights, incident learnings, and control effectiveness reviews
Managing and optimizing budget and resources to support governance, risk, and compliance capabilities