Sr Cybersecurity Governance, Risk and Compliance Manager

BECU•Remote, WA, WA

1d•$121,200 - $225,800•Hybrid

About The Position

BECU is hiring a Senior Cybersecurity Governance, Risk and Compliance (GRC) Manager to strengthen protection of its members, information, and financial assets through cybersecurity governance and control oversight. This senior individual contributor will help shape and mature the cybersecurity governance program, translate frameworks and regulatory expectations into practical standards and controls, and help establish second-line cybersecurity control oversight. The role partners with first-line control and solution owners to identify control gaps and support remediation. The position will help advance Continuous Control Monitoring (CCM) and modernize GRC through AI-enabled capabilities, automation, reporting, and connected workflows. It will develop metrics and dashboards, support regulatory examinations, strengthen cybersecurity maturity, and represent cybersecurity perspectives in AI governance. Success requires influencing across Cybersecurity, Technology, Enterprise Compliance, architecture, IAM, and other teams without relying on direct authority. Candidates must reside in WA, OR, ID, AZ, TX, GA, SC, NC, CA, or VA. Washington residents within reasonable driving distance of Tukwila are requested to work at headquarters on Tuesdays and Wednesdays. Candidates outside the commute distance and located in an approved remote-work state will work remotely.

Requirements

Typically requires a bachelor’s degree in Information Security, Computer Science, or a related field, or equivalent work or education-related experience.
Typically requires 7 years of cybersecurity or related experience in IT, Compliance, or Audit.
Expertise leveraging established GRC frameworks, including FFIEC guidance, GLBA controls, PCI/DSS controls, SOX, NIST CSF, and other relevant laws and regulations, particularly to improve cybersecurity maturity in an enterprise environment.
Demonstrated ability to collaborate with and influence stakeholder and partner organizational leadership and management, including vendors and third parties.
Working knowledge of GRC tools, automation of risk evaluation, integration with enterprise risk functions, and reporting.
Understanding of information and security systems to identify risk exposure, including third-party cyber risk.
Ability to work independently and as a team member, using discretion and sound judgment in decision-making and problem-solving.
Ability to set training goals and objectives, develop lesson plans, present programs, and provide training materials to individuals and groups.
Working knowledge of firewalls, vulnerability management, penetration testing, server and desktop configuration and controls, and encryption.
Demonstrated ability to share knowledge and help others understand technical and business topics.
Must reside in WA, OR, ID, AZ, TX, GA, SC, NC, CA, or VA.

Nice To Haves

Advanced degree preferred.
One or more of the following certifications, or equivalent certifications, preferred: CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications such as PCIP, ISA, or QSA.

Responsibilities

Partner with Cybersecurity leadership to develop, evolve, and continuously improve GRC programs, processes, standards, guidelines, and supporting disciplines.
Help establish and mature second-line oversight of the cybersecurity control framework, providing credible challenge and partnering with first-line control and solution owners to identify gaps, clarify ownership, and drive remediation.
Partner with Enterprise Compliance and other stakeholders to support cybersecurity-related regulatory examinations, including NCUA and Washington State DFI engagements; coordinate evidence, responses, findings, and remediation as appropriate.
Translate cybersecurity frameworks, regulatory expectations, and evolving requirements into practical standards, guidelines, control expectations, and operating practices.
Advance Continuous Control Monitoring by connecting requirements with automated monitoring, control-gap identification, issue management, remediation workflows, dashboards, and reporting.
Identify opportunities to reduce repetitive manual work through workflow automation, integrations, AI-enabled capabilities, Power BI, Power Automate, and the Microsoft Power Platform.
Use established cybersecurity frameworks and assessment results to identify improvement opportunities, develop action plans, and advance cybersecurity maturity across the enterprise.
Identify potential control or framework-compliance issues, engage accountable owners, provide oversight, and escalate concerns when appropriate.
Create and maintain cybersecurity performance and risk metrics, dashboards, and reporting that show control health, remediation, ownership, and progress.
Build relationships across Cybersecurity, Technology, Enterprise Compliance, enterprise architecture, IAM, AI governance, and other teams to move complex initiatives forward.
Represent cybersecurity perspectives in AI governance and translate cybersecurity and risk-management expectations into practical requirements for responsible adoption of emerging technologies.
Adapt cybersecurity standards and guidelines to changes in technology, organizational needs, regulatory expectations, and the threat landscape, including PCI-related governance considerations.
Help stakeholders understand cybersecurity governance expectations and contribute to awareness and education.
Perform other duties as assigned in support of cybersecurity governance, risk, compliance, and control objectives.