Technology Governance Policy Lead

HUB International • Chicago, IL

3d • $120,000 - $140,000

About The Position

The Technology Governance Policy Lead develops and operates the policy and risk-tracking capability within HUB’s Technology Governance function. The role ensures technology policies are well written, approved, adopted, and enforced, and that technology risks remain visible and owned. Acting as an extension of Technology Governance leadership, the Policy Lead engages stakeholders, carries governance priorities into working sessions and executive discussions, and exercises judgment about what is negotiable and what must be escalated. The role maintains a focused risk log but does not own risk appetite, quantitative risk modeling, or enterprise risk methodology.

The Policy Lead partners across Technology, Security, Operations, Legal, HR, and Finance to coordinate the experience of policy owners and control owners. The role oversees policy authorship, writes or co-authors policies when needed, translates regulatory requirements into clear and enforceable language, coordinates reviews and approvals, and connects policy requirements to operational processes, controls, and owners. It also supports implementation and enforcement planning, maintains a Technology and Operations risk log, researches regulatory and industry topics, prepares executive materials, presents items to committees when asked, and tracks decisions and follow-up actions.

Requirements

• Senior-level, progressive experience in IT governance, policy development, GRC, technology risk, or compliance in a regulated environment.
• Exceptional professional writing skills, including the ability to produce polished, precise, audience-aware policy text, executive-ready briefs, and decision records.
• Strong presentation skills and the ability to present policy, risk, and research clearly and confidently to executive committees and cross-functional leaders, and to respond to challenges in the room.
• Strong working knowledge of SOX, SOC 2, and ITGC control domains, with the ability to translate requirements into policy language that satisfies an auditor.
• Demonstrated discipline in owning and maintaining a risk or issue log and following up with stakeholders through closure.
• Strong research and synthesis skills, including the ability to turn regulatory, legal, or industry material into clear briefs for Legal, HR, Finance, and Technology audiences.
• Executive presence and political fluency to engage stakeholders at all levels.
• Sound judgment about when to act within delegated authority and when to escalate.

Nice To Haves

• Audit readiness or compliance-by-default experience, including ITSM tooling and continuous improvement pipelines.
• Experience operating in a pre-formal-function environment and building scaffolding that a later, more formal team will inherit.

Responsibilities

• Guide and oversee policy owners who write their own policies, setting expectations for format, quality, and consistency with HUB’s standard policy format.
• Author policies directly when needed and co-author policies with subject matter owners across Technology, Security, Operations, Legal, HR, and Finance.
• Translate regulatory requirements, including SOX, SOC 2, and ITGC, into clear, enforceable, audit-ready policy language.
• Socialize policy drafts with stakeholders before formal review to gather input, build understanding and buy-in, and surface objections early.
• Track policies in progress, follow up with reviewers and approvers, and escalate stalled approvals.
• Review policies periodically and in response to regulatory updates, audit findings, incidents, or organizational change; propose revisions and maintain version control and approval trails.
• Map policy requirements to the processes, controls, and owners responsible for carrying them out.
• Help develop implementation plans and enforcement mechanisms, including rollout steps, owners, timelines, compliance checks, accountability, and exception handling.
• Maintain a running risk log across Technology and Operations activities.
• Work with stakeholders to translate regulatory and audit findings into tracked risk items with clear ownership.
• Follow up with risk owners for status updates and flag stale, escalating, or orphaned risk items.
• Keep the risk log structured so it can be handed off intact when a formal ERM function is established.
• Research regulatory and framework requirements, peer and industry practices, and policy precedents in support of Legal, HR, Finance, and Technology teams.
• Turn research into concise, polished briefs stakeholders can act on.
• Connect functions when policy or risk questions cross team boundaries and identify where input is needed before work proceeds.
• Prepare clear, professional decks and pre-reads for executive committee sessions involving risk or policy decisions.
• Present policy, risk, and research items to the committee when called on, framing the decision and supporting a clear outcome.
• Maintain a decision log recording what was decided, by whom, and what is required, and follow through until actions are complete.

Benefits

• Comprehensive health, dental, vision, life, and disability insurance.
• Flexible spending accounts (FSA) and health savings accounts (HSA).
• 401(k) accounts and retirement savings matching.
• Company-paid life and disability plans.
• Paid time off, including vacation, sick, personal, floating holidays, and company holidays.
• Paid parental leave.
• Wellbeing program.
• Structured training, licensing support, and ongoing development opportunities.
• Eligible annual bonuses, equity, and commissions may be available for some positions.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed