Director, Governance
for section headings. Use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive info; do not invent or summarize away detail.
Let's extract About the role paragraph:
"About The RoleThe Director, Governance owns the foundational infrastructure every other GRC pillar depends on. Without a policy library, Compliance has nothing to test. Without regulatory horizon scanning, risk finds Riot before Riot finds risk. Without a contracts management program, vendor and third-party risk runs unchecked. Governance is the bedrock of this program — and this role builds it from near zero in Year 1. This pillar is intentionally scoped to govern, not to test or audit. Governance owns the full lifecycle of policies and standards: drafting, approval routing, versioning, publication, and attestation tracking. Governance owns the ISO 27001:2022 documentation framework — all mandatory policy and procedure documents required for certification. Governance owns the regulatory radar, the Contracts Management program (in co-ownership with Legal), and the Third-Party Risk Management program (in partnership with Procurement). You will report to the Senior Director, GRC and maintain a co-ownership relationship with the Chief Legal Officer on Contracts Management, where Legal holds final sign-off authority at every material decision gate. In critical operations, you will engage mining site and data center leadership to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the enterprise governance framework."
We need to split into sentences but keep as prose
.
Responsibilities: "What You'll Do" list items:
- Build and own the ISO 27001:2022 documentation framework: identify and produce all mandatory policies, procedures, and records required for certification, map them to Annex A controls, and drive adoption through executive sponsorship and attestation programs — this is the Year 1 priority with a contractually fixed delivery timeline.
- Build and operate the Riot policy and standards library from near-zero baseline: establish the governance model (drafting, review routing, approval gates, versioning, renewal cadences), and extend scope beyond ISO 27001 to cover SOC 2, SOX, and enterprise policy requirements.
- Own the regulatory horizon scanning program: monitor developments across critical infrastructure, digital assets, data privacy, and financial services; translate regulatory signals into GRC program actions; and deliver regular briefings to the Sr. Director and executive leadership.
- Stand up the Contracts Management program in co-ownership with Legal: design the intake-to-repository workflow, establish GRC risk flagging criteria (data processing, liability, security, regulatory), and implement the Legal sign-off gate — Legal approves, GRC operates.
- Own the Third-Party Risk Management (TPRM) and vendor risk program: build the vendor tiering model, define due diligence requirements by tier, partner with Procurement on intake integration, and establish ongoing monitoring cadences for critical and colocation vendors.
- Manage the GRC framework lifecycle: maintain Riot's mapping of policies and controls to SOC 2 Trust Services Criteria, ISO 27001, NIST CSF, and applicable regulatory frameworks — keeping the library current as the regulatory and audit environment evolves.
- Engage critical operations to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the governance framework and aligned to enterprise GRC standards.
We need to put each as
- inside
.
Requirements/Qualifications/Skills: "What You'll Bring" list:
- 8–12+ years of progressive GRC, policy management, regulatory affairs, or governance program experience at a publicly traded or highly regulated company.
- ISO 27001 Lead Implementer certification — required. The Director, Governance is the primary owner of ISO 27001:2022 policy and documentation implementation. Riot has an active, contractually required certification obligation; this credential is a baseline requirement, not a differentiator.
- Demonstrated experience building a policy library from a minimal baseline — governance model design, framework mapping, attestation program rollout, and cross-functional adoption.
- Experience standing up or operating a Contracts Management program with Legal co-ownership — contract risk review, DPA requirements, and GRC-Legal governance models.
- Working knowledge of TPRM frameworks and vendor risk program design — tiering models, due diligence questionnaires, and ongoing monitoring processes.
- Proven regulatory horizon scanning capability across critical infrastructure, digital assets, and data privacy (CISA, FinCEN, state privacy laws, DORA, NIS2 familiarity).
- Experience mapping a policy library to multiple frameworks simultaneously (SOC 2, ISO 27001, NIST CSF) to support a unified audit and control program.
- Strong cross-functional communication and influence: ability to drive policy adoption and contracts governance across Legal, Procurement, HR, and Operations without direct authority.
- Preferred: CISM, CGEIT, CRISC, or CIPP/US certification; experience in critical infrastructure, energy, data center, or digital asset environments.
We need to decide headings. Could combine into Requirements (experience, certifications) and Skills (cross-functional communication). But we have limited time; maybe just one section "Requirements" covering all. The instruction: prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Requirements, Benefits.
Thus we will not have separate Qualifications or Skills headings.
Now Benefits section: list items:
- Competitive Salary: Base range (commensurate with experience) + bonus + sign-on equity grant. (But we decided to omit Pay; but this is part of Compensation And Benefits. However the Benefits section we already have includes other items; we could include compensation details as part of Benefits? The heading is Benefits, but we could still include compensation details there. However the instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") . The compensation line includes "Base range (commensurate with experience)" which is filler. If we include it, we would have filler text. Might be better to omit that line from Benefits. But we could keep the other benefits items and exclude the compensation line. However we must preserve ALL substantive information; we cannot omit the compensation info. The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we must include the compensation info somewhere. If we include it, we risk having filler text. But maybe we can rephrase to avoid filler? We cannot invent or summarize away detail, but we can maybe keep the exact text; the filler phrase is part of the original. The rule says never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") . It says heading followed by filler/placeholder text. If we have a Benefits heading and under it we have a list that includes an item with filler text, is that considered heading followed by filler? The rule likely means if the section only contains filler text, not if there is some filler within substantive content. It's ambiguous. Safer to keep the compensation line as part of Benefits list; it's substantive (includes bonus, equity). The filler phrase is part of the line but not the whole section. So we can include.
Thus Benefits section will have a with items:
- Competitive Salary: Base range (commensurate with experience) + bonus + sign-on equity grant.
- Long-Term Growth: Eligible to participate in Riot’s equity incentive programs and share in the success you help build.
- 401(k) Retirement Plan: Includes a generous company match.
- Comprehensive Health Coverage: Multiple medical plan options, including 100% company-paid plans.
- Wellness & Lifestyle Perks: Enjoy free gym memberships, pet insurance, childcare discounts, and more to support your life both in and out of work.
Note: there is a typo "Incudes" in original; we should preserve as is? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep "Incudes". Keep exactly as given.
Now we need to output HTML fragment only.
Structure:
About the role
...
Responsibilities
- ...
...
Requirements
- ...
...
Benefits
- ...
...
Make sure no extra whitespace? It
for prose. We need to preserve all substantive info; do not invent or summarize away detail. Let's extract About the role paragraph: "About The RoleThe Director, Governance owns the foundational infrastructure every other GRC pillar depends on. Without a policy library, Compliance has nothing to test. Without regulatory horizon scanning, risk finds Riot before Riot finds risk. Without a contracts management program, vendor and third-party risk runs unchecked. Governance is the bedrock of this program — and this role builds it from near zero in Year 1. This pillar is intentionally scoped to govern, not to test or audit. Governance owns the full lifecycle of policies and standards: drafting, approval routing, versioning, publication, and attestation tracking. Governance owns the ISO 27001:2022 documentation framework — all mandatory policy and procedure documents required for certification. Governance owns the regulatory radar, the Contracts Management program (in co-ownership with Legal), and the Third-Party Risk Management program (in partnership with Procurement). You will report to the Senior Director, GRC and maintain a co-ownership relationship with the Chief Legal Officer on Contracts Management, where Legal holds final sign-off authority at every material decision gate. In critical operations, you will engage mining site and data center leadership to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the enterprise governance framework." We need to split into sentences but keep as prose
. Responsibilities: "What You'll Do" list items: - Build and own the ISO 27001:2022 documentation framework: identify and produce all mandatory policies, procedures, and records required for certification, map them to Annex A controls, and drive adoption through executive sponsorship and attestation programs — this is the Year 1 priority with a contractually fixed delivery timeline. - Build and operate the Riot policy and standards library from near-zero baseline: establish the governance model (drafting, review routing, approval gates, versioning, renewal cadences), and extend scope beyond ISO 27001 to cover SOC 2, SOX, and enterprise policy requirements. - Own the regulatory horizon scanning program: monitor developments across critical infrastructure, digital assets, data privacy, and financial services; translate regulatory signals into GRC program actions; and deliver regular briefings to the Sr. Director and executive leadership. - Stand up the Contracts Management program in co-ownership with Legal: design the intake-to-repository workflow, establish GRC risk flagging criteria (data processing, liability, security, regulatory), and implement the Legal sign-off gate — Legal approves, GRC operates. - Own the Third-Party Risk Management (TPRM) and vendor risk program: build the vendor tiering model, define due diligence requirements by tier, partner with Procurement on intake integration, and establish ongoing monitoring cadences for critical and colocation vendors. - Manage the GRC framework lifecycle: maintain Riot's mapping of policies and controls to SOC 2 Trust Services Criteria, ISO 27001, NIST CSF, and applicable regulatory frameworks — keeping the library current as the regulatory and audit environment evolves. - Engage critical operations to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the governance framework and aligned to enterprise GRC standards. We need to put each as
- .
Requirements/Qualifications/Skills: "What You'll Bring" list:
- 8–12+ years of progressive GRC, policy management, regulatory affairs, or governance program experience at a publicly traded or highly regulated company.
- ISO 27001 Lead Implementer certification — required. The Director, Governance is the primary owner of ISO 27001:2022 policy and documentation implementation. Riot has an active, contractually required certification obligation; this credential is a baseline requirement, not a differentiator.
- Demonstrated experience building a policy library from a minimal baseline — governance model design, framework mapping, attestation program rollout, and cross-functional adoption.
- Experience standing up or operating a Contracts Management program with Legal co-ownership — contract risk review, DPA requirements, and GRC-Legal governance models.
- Working knowledge of TPRM frameworks and vendor risk program design — tiering models, due diligence questionnaires, and ongoing monitoring processes.
- Proven regulatory horizon scanning capability across critical infrastructure, digital assets, and data privacy (CISA, FinCEN, state privacy laws, DORA, NIS2 familiarity).
- Experience mapping a policy library to multiple frameworks simultaneously (SOC 2, ISO 27001, NIST CSF) to support a unified audit and control program.
- Strong cross-functional communication and influence: ability to drive policy adoption and contracts governance across Legal, Procurement, HR, and Operations without direct authority.
- Preferred: CISM, CGEIT, CRISC, or CIPP/US certification; experience in critical infrastructure, energy, data center, or digital asset environments.
We need to decide headings. Could combine into Requirements (experience, certifications) and Skills (cross-functional communication). But we have limited time; maybe just one section "Requirements" covering all. The instruction: prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Requirements, Benefits.
Thus we will not have separate Qualifications or Skills headings.
Now Benefits section: list items:
- Competitive Salary: Base range (commensurate with experience) + bonus + sign-on equity grant. (But we decided to omit Pay; but this is part of Compensation And Benefits. However the Benefits section we already have includes other items; we could include compensation details as part of Benefits? The heading is Benefits, but we could still include compensation details there. However the instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") . The compensation line includes "Base range (commensurate with experience)" which is filler. If we include it, we would have filler text. Might be better to omit that line from Benefits. But we could keep the other benefits items and exclude the compensation line. However we must preserve ALL substantive information; we cannot omit the compensation info. The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we must include the compensation info somewhere. If we include it, we risk having filler text. But maybe we can rephrase to avoid filler? We cannot invent or summarize away detail, but we can maybe keep the exact text; the filler phrase is part of the original. The rule says never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") . It says heading followed by filler/placeholder text. If we have a Benefits heading and under it we have a list that includes an item with filler text, is that considered heading followed by filler? The rule likely means if the section only contains filler text, not if there is some filler within substantive content. It's ambiguous. Safer to keep the compensation line as part of Benefits list; it's substantive (includes bonus, equity). The filler phrase is part of the line but not the whole section. So we can include.
Thus Benefits section will have a
- ... ...
- ... ...
- ... ...
- with items:
- Competitive Salary: Base range (commensurate with experience) + bonus + sign-on equity grant.
- Long-Term Growth: Eligible to participate in Riot’s equity incentive programs and share in the success you help build.
- 401(k) Retirement Plan: Includes a generous company match.
- Comprehensive Health Coverage: Multiple medical plan options, including 100% company-paid plans.
- Wellness & Lifestyle Perks: Enjoy free gym memberships, pet insurance, childcare discounts, and more to support your life both in and out of work.
Note: there is a typo "Incudes" in original; we should preserve as is? The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep "Incudes". Keep exactly as given.
Now we need to output HTML fragment only.
Structure:
About the role
...