Vice President, IT Governance, Risk & Compliance

Northwestern Mutual•Milwaukee, WI

3d•$220,000 - $330,000

About The Position

We are seeking an experienced, forward-thinking Vice President of IT Governance, Risk & Compliance (IT GRC) to lead and transform the enterprise IT GRC function. This executive leader will be responsible for establishing and advancing a modern, technology-enabled governance, risk, compliance, and regulatory response program that supports the company mission, protects customers, and enables business growth. This role requires an exceptional leader who can operate at the intersection of cybersecurity, technology, risk management, audit, regulation, and business strategy. The successful candidate will possess deep knowledge of cybersecurity and technology risks, extensive experience within highly regulated industries, and a demonstrated ability to build scalable programs leveraging automation, data intelligence, continuous assurance, and artificial intelligence. The Vice President will serve as a trusted advisor to executive leadership, regulators, auditors, and business stakeholders while driving a culture of accountability, transparency, and risk-informed decision making across the enterprise.

Requirements

A cybersecurity leader who understands governance and compliance, not simply a compliance leader who understands regulations.
A technology strategist who understands how platforms, integrations, automation, and AI enable scalable risk management.
15+ years of progressive leadership experience across IT governance, risk management, compliance, audit, cybersecurity, or technology management.
Demonstrated experience leading large-scale enterprise programs within a highly regulated environment.
Strong understanding of information technology, cybersecurity architectures, cloud technologies, identity and access management, data protection, and technology operations.
Extensive experience managing regulatory compliance programs and interactions with internal and external auditors.
Proven experience presenting to executive leadership teams, board committees, regulators, and auditors.
Demonstrated success developing enterprise-wide governance, risk, compliance, or cybersecurity programs.
Exceptional executive communication, influencing, and relationship management skills.

Nice To Haves

Experience within the insurance industry strongly preferred.
Experience within financial services, banking, wealth management, or other highly regulated industries.
Prior leadership experience in a cybersecurity discipline such as cyber defense, security engineering, identity and access management, security architecture, incident response, risk management, or security operations.
Experience implementing or leading modern GRC platforms and technology-enabled compliance programs.
Experience leading large-scale compliance transformations, automation initiatives, or digital modernization programs.
Knowledge of emerging AI governance, model risk management, and technology ethics practices.
Professional certifications such as CISSP, CISM, CRISC, CGEIT, CISA, CPA, CIA, or equivalent.

Responsibilities

Develop and execute a multi-year vision and strategy for the IT GRC organization aligned with enterprise objectives, technology strategy, and cybersecurity priorities.
Transform traditional compliance and risk management practices into a modern, data-driven operating model emphasizing automation, scalability, and continuous monitoring.
Build a high-performing organization that attracts, develops, and retains top talent across governance, compliance, risk management, and regulatory disciplines.
Partner closely with Cybersecurity, Technology, Enterprise Risk Management, Internal Audit, Legal, Privacy, and business leadership to ensure integrated risk management across the enterprise.
Oversee enterprise IT governance frameworks, policies, standards, controls, and risk management processes.
Ensure effective identification, assessment, measurement, monitoring, and reporting of technology and cybersecurity risks.
Drive maturation of risk management capabilities through improved metrics, analytics, and automation.
Develop meaningful executive and board-level reporting that translates technical risks into business and financial impacts.
Lead compliance efforts related to applicable technology and cybersecurity regulations and standards.
Maintain readiness for regulatory examinations and external reviews.
Serve as the primary executive sponsor for technology and cybersecurity audits, examinations, and regulatory engagements.
Establish sustainable and defensible compliance practices that withstand both regulatory and audit scrutiny.
Drive remediation of audit findings and regulatory concerns through risk-based prioritization and measurable outcomes.
Provide strategic oversight for technology and cybersecurity governance programs.
Partner with cybersecurity leadership to assess and manage emerging threats, control effectiveness, security maturity, and operational risk.
Apply practical cybersecurity experience to improve governance and risk outcomes rather than relying solely on theoretical compliance models.
Maintain awareness of evolving threat landscapes, technology trends, cloud risks, AI-related risks, and cybersecurity regulations.
Champion modernization of IT GRC practices through automation, workflow orchestration, advanced analytics, and data-driven decision making.
Lead the adoption of continuous assurance capabilities that reduce manual evidence collection and repetitive compliance activities.
Drive elimination of duplicate processes and fragmented controls across governance, risk, and compliance programs.
Establish governance frameworks and oversight mechanisms for emerging AI technologies and AI-enabled business processes.
Foster a culture that embraces innovation while maintaining appropriate risk management and regulatory compliance.
Serve as a trusted advisor to the CISO, CIO, executive leadership team, and governance committees.
Deliver concise, compelling, and actionable briefings to senior executives, board committees, auditors, and regulators.
Translate complex technical, cyber, and regulatory issues into language appropriate for executive and board audiences.
Build strong relationships across the organization to influence decision making and achieve strategic outcomes.