Governance, Risk & Compliance (GRC) Manager

Position Summary

This position manages the corporate governance, risk, and compliance (GRC) teams, including internal security review, security contract review, and vendor risk management. The GRC Program Manager supervises employees across experience levels and works with IT compliance stakeholders to assess risk and provide practical guidance aligned with Milliman’s risk appetite. The position works with 60+ offices worldwide and their local administrators to coordinate internal assessments, support external audits, and identify and assess critical vendors. The position reports directly to the Chief Information Security Officer (CISO) and resides within Global Corporate Services (GCS).

Responsibilities

• Manage the Global GRC team across regions and serve as an escalation point for complex issues.
• Talent Management: Support hiring, performance reviews, compensation discussions, and staffing decisions.
• Client Engagement: Work with GCS Legal and business stakeholders on information security contract requirements, escalating to the CISO as needed.
• Monitor Regulatory Requirements: Monitor applicable requirements, including HIPAA, GDPR, and CCPA, and assess impact to GRC responsibilities.
• Support Compliance Initiatives: Work with GDPT and internal stakeholders to support regulatory and client compliance requirements.
• Oversee Vendor Risk Management: Oversee vendor security risk processes and support alignment with vendor management.
• Track Team Performance: Monitor team performance against SLAs and address gaps as needed.
• Report on Program Performance: Provide program updates and align GRC work with organizational priorities.
• Career Development: Coordinate with IT, Legal, Finance, and GCS leadership on risk and compliance priorities.
• Communicate and Share risk and compliance updates and support targeted security training when policies or gaps require it.

Functional Competencies

• Ability to find opportunities for efficiencies, using state of the art software tools and AIRisk Management: Understanding of risk management methodologies, frameworks, and principles for measuring, reporting, and mitigating risk.
• Communication & Collaboration: Ability to communicate clearly with business and technical stakeholders and translate technical concepts into practical guidance.
• Project & Time Management: Ability to manage multiple projects, prioritize work, and support timely completion of assigned activities.
• Global & Cross-Functional Engagement: Ability to work with stakeholders across geographically dispersed offices and support coordination across business functions.

Skills & Qualifications

• Bachelor's degree in Risk Management, Information Systems, Computer Science, or Cybersecurity (or equivalent years of relevant professional hands-on work experience).
• The ideal candidate should have minimum 7 years of hands-on IT Cybersecurity or Risk Management experience.
• Skills & Qualifications Preferred:
• Certified in at least one of the following: Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) or willingness to obtain.
• Experience using GRC/VRM tools and platforms.
• Experience with HIPAA/HITRUST, GDPR, ISO 27001 /2, and other industry regulatory controls and compliance.
• Experience within consulting or professional service organizations.
• Experience with SharePoint administration.

Location

This is a remote role. The expected application deadline for this job is July 31, 2026.

Compensation

The overall range for this role is $117,500 - $222,985. For candidates residing in: Alaska, California, Connecticut, Illinois, Maryland, Massachusetts, New Jersey, New York City, Pennsylvania, Virginia, Washington, or the District of Columbia the range is $135,125 - $222,985. All other locations the range is $117,500 - $193,900. A combination of factors will be considered, including, but not limited to, education, relevant work experience, qualifications, skills, certifications, etc.

Benefits

• Medical, Dental and Vision – Coverage for employees, dependents, and domestic partners.
• Employee Assistance Program (EAP) – Confidential support for personal and work-related challenges.
• 401(k) Plan – Includes a company matching program and profit-sharing contributions.
• Discretionary Bonus Program – Recognizing employee contributions.
• Flexible Spending Accounts (FSA) – Pre-tax savings for dependent care, transportation, and eligible medical expenses.
• Paid Time Off (PTO) – Begins accruing on the first day of work. Full-time employees accrue 15 days per year, and employees working less than full-time accrue PTO on a prorated basis.
• Holidays – A minimum of 10 paid holidays per year.
• Family Building Benefits – Includes adoption and fertility assistance.
• Paid Parental Leave – 11 weeks of paid leave for employees who meet eligibility criteria.
• Life Insurance & AD&D – 100% of premiums covered by Milliman.
• Short-Term and Long-Term Disability – Fully paid by Milliman.

About Milliman

Independent for over 77 years, Milliman delivers market-leading services and solutions to clients worldwide. Today, we are helping companies take on some of the world’s most critical and complex issues, including retirement funding and healthcare financing, risk management and regulatory compliance, data analytics and business transformation. Through a team of professionals ranging from actuaries to clinicians, technology specialists to plan administrators, we offer unparalleled expertise in employee benefits, investment consulting, healthcare, life insurance and financial services, and property and casualty insurance.

Equal Opportunity

All qualified applicants will receive consideration for employment, without regard to race, color, religion, sex, sexual orientation, national origin, disability, or status as a protected veteran.