VP, Cybersecurity Governance, Risk and Compliance

Acrisure•Atlanta, GA

5d•Onsite

About The Position

We are seeking an experienced Vice President of Cybersecurity Governance, Risk & Compliance to build and lead Acrisure’s global cybersecurity governance, risk, and regulatory assurance function, establishing the operating model that translates cybersecurity risk into clear executive decisions and board-level visibility. In this role, you will set and operate the cyber governance model for a fast growing, highly acquisitive international fintech organization, ensuring risks are clearly identified, prioritized, and communicated to executive leadership and the board. You will own cybersecurity governance, enterprise board-level management, regulatory readiness, audit, and examination response, IT general controls alignment, and security awareness and phishing resilience programs. Working closely with leaders across Cybersecurity, Technology, Legal (privacy), Operations, and Enterprise Risk Management, you will establish a scalable, defensible control environment that meets increasing regulatory and audit expectations while enabling business growth. This role reports directly to the CISO, operates with enterprise‑level decision authority, and serves as a core member of the cybersecurity leadership team. Success requires deep expertise in cybersecurity risk and compliance within regulated environments, strong executive presence, and the ability to lead through influence in a complex, global, and rapidly evolving organization.

Requirements

Bachelor's degree required; CISSP, CISM, or CRISC strongly preferred; Master's degree a plus.
10+ years of experience across cybersecurity governance, risk management, compliance, audit, or assurance in regulated industries.
5+ years of experience leading teams and influencing senior executives.
Demonstrated ability to build scalable governance, risk, and assurance programs in high growth or acquisitive environments.
Strong executive communication skills including board level writing and presentations.
Strong knowledge of cybersecurity and control frameworks such as NIST, ISO 27001, SOC, and financial regulatory environments.
Experience managing audits, regulatory exams, and enterprise risk or control frameworks.
Exceptional communication, stakeholder management, and problem-solving skills.
Proven ability to lead projects and influence across a matrixed organization.
Experience with GRC tools (e.g., OneTrust, Archer, LogicGate, ServiceNow GRC) preferred.

Nice To Haves

CISSP, CISM, or CRISC strongly preferred
Master's degree a plus

Responsibilities

Own the operating cadence for the Cybersecurity Governance Committee (CyberGov), including agenda development, pre-read preparation, meeting facilitation, and follow through with decisions and action items. Ensure CyberGov functions as an active governance vehicle.
Own the cybersecurity governance operating model, including policy lifecycle management, standards hierarchy, exception governance, and evidence of adoption.
Translate executive approved cybersecurity policies into clear, enforceable standards and operating procedures that scale globally.
Partner with IT and business leaders to ensure cybersecurity standards are embedded into core operating processes.
Own the enterprise cybersecurity risk management program, including risk identification, scoring, treatment, acceptance, and reporting.
Maintain the cybersecurity risk register and ensure risks are translated into clear decisions, prioritized remediation plans, and executive ready reporting.
Partner with Enterprise Risk Management to integrate cyber risk appropriately into broader enterprise risk routines.
Translate enterprise risk appetite into actionable cybersecurity decision frameworks and risk thresholds.
Lead cybersecurity compliance readiness across applicable regulatory regimes and expectations, including NYDFS 500, FCA/DORA, and a trajectory toward SOX and SEC audit readiness.
Continuously monitor regulatory and supervisory changes and drive corresponding enhancements to the cybersecurity program.
Ensure global consistency in cyber controls while accounting for regional regulatory differences.
Own the end-to-end cybersecurity audit and examination operating model, including intake, scoping, evidence management, response coordination, issue remediation, and closure.
Serve as the single point of accountability for all cybersecurity audits and examinations (internal and external).
Ensure audit outcomes drive sustained control and process improvement.
Define and align cyber-relevant IT General Controls with IT and Operations, including access governance, change management, logging and monitoring, vulnerability and patch governance, and backup and recovery.
Establish a sustainable approach to control assurance and evidence production aligned to audit and regulatory expectations.
Lead cybersecurity due diligence and provide clear, decision-ready risk assessments for mergers and acquisitions.
Partner with IT and integration teams to ensure visibility and accountability for post-acquisition cybersecurity uplift toward company standards.
Own a repeatable M&A cyber due diligence playbook and drive cybersecurity into the deal team process.
Own the enterprise security awareness and training program, including role-based training, completion discipline, and effectiveness measurement.
Own the phishing simulation and resilience program, using results to drive targeted risk reduction.
Promote a culture where cybersecurity is embedded into how the business operates.
Develop and maintain a concise set of cybersecurity KPIs and KRIs that reflect risk posture, control health, remediation velocity, and audit readiness.
Deliver clear, consistent, and decision-oriented reporting to executive leadership, Cyber Governance, and other senior forums.
Provide global visibility across regions while maintaining consistent definitions and expectations.
Define and execute a GRC modernization roadmap that reduces manual process dependency, accelerates audit evidence cycles, and improves executive risk visibility.
Drive adoption of AI-assisted workflows across risk identification, control assurance, and issue tracking. Establish measurable baselines and report progress against them.
Lead and scale a global Cybersecurity GRC organization
Set a high bar for clarity, accountability, and execution.
Build strong cross functional partnerships and lead effectively in a decentralized, fast-moving environment.