GRC Program Manager - Remote

About the role

The GRC (Governance, Risk, & Compliance) Program Manager at Velera is a critical role in ensuring the company adheres to applicable cyber laws, regulations, and information security policies and standards. The position involves designing, implementing, and governing cyber risk management and technology compliance activities.

Responsibilities

• Design, scope, and execute program(s) to achieve stated objectives in alignment with business strategies and priorities
• Plan, schedule, and oversee internal/external system user attestations across the enterprise
• Assess and consult on third-party cyber risks
• Review and negotiate cyber contracts
• Coordinate IT components of onsite and virtual audits/assessments (e.g., SOC1/2, PCI DSS/NIST CSF), NCUA regulatory examinations, and client due diligence reviews
• Implement and execute assigned program(s) through the use of a GRC tool and in accordance with company reporting and certification deadlines (e.g., PCI DSS, NIST CSF, SOC1/2)
• Gain support and buy-in by educating employees about program objectives, controls, and their responsibilities in mitigating cyber risks
• Lead and manage cyber risk management and technology compliance initiatives
• Interpret and translate cybersecurity and compliance requirements into program design
• Proactively identify and monitor emerging cybersecurity threats and regulatory landscape; adapt program design, scope, and execution to mitigate risks and comply with new regulation
• Collaborate and partner with cross-functional business and technology stakeholders at all levels to ensure program objectives are met; work with internal/external auditors, vendors, and clients as required
• Monitor and assess program governance and effectiveness (e.g., QA reviews, control testing)
• Define and report on Key Performance Indicators (KPIs)
• Identify and implement process improvements to drive program efficiencies, minimize impact to business operations, and enhance user experiences; incorporate Inspired Service elements into program design where possible

Requirements

• Eight (8) years of relevant experience in cyber GRC, technology controls consulting, PCI/NIST CSF assessments, IT internal/external auditing, or cyber risk management
• At least five (5) years in a GRC program manager or equivalent role identifying, assessing, and mitigating information security, technology compliance, and cyber risks
• Implementation of GRC tool (Optro, Vanta, Drata, OneTrust) and control automation required
• Experience in Financial Services, Fintech, SaaS environments highly preferred

Qualifications

• Eight (8) years of relevant experience in cyber GRC, technology controls consulting, PCI/NIST CSF assessments, IT internal/external auditing, or cyber risk management
• At least five (5) years in a GRC program manager or equivalent role identifying, assessing, and mitigating information security, technology compliance, and cyber risks
• Implementation of GRC tool (Optro, Vanta, Drata, OneTrust) and control automation required
• Experience in Financial Services, Fintech, SaaS environments highly preferred

Skills

• Strong knowledge of cyber risk management and technology compliance
• Ability to lead and manage complex projects
• Excellent communication and collaboration skills
• Proficient in GRC tools and control automation
• Understanding of regulatory requirements and industry standards

Benefits

• Competitive wages
• Medical with telemedicine
• Dental and Vision
• Basic and Optional Life Insurance
• Paid Time Off (PTO)
• Maternity, Parental, Family Care
• Community Volunteer Time Off
• 12 Paid Holidays
• Company Paid Disability Insurance
• 401k (with employer match)
• Health Savings Accounts (HSA) with company provided contributions
• Flexible Spending Accounts (FSA)
• Supplemental Insurance
• Mental Health and Well-being: Employee Assistance Program (EAP)
• Tuition Reimbursement
• Wellness program

Pay

$110,100.00 - $143,100.00 Actual Pay will be adjusted based on experience and other job-related factors permitted by law.

Schedule

Velera offers a remote-first, flexible environment.