Lead, Information Security - Governance, Risk & Compliance

We need to output HTML fragment with sections: About the role (maybe not needed? The description includes role description). The instruction: use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. Do NOT put Job ID / requisition numbers as headings. Preserve ALL substantive information; do NOT invent or summarize away detail. Remove boilerplate etc. Include a section ONLY when posting has real, specific content for it — never emit a heading followed by filler/placeholder text (e.g. "commensurate with experience", "not specified", "N/A", "varies", "TBD") and never create Pay/Schedule/Benefits sections unless posting actually states them. We have salary range: "The anticipated base salary for this position is $142,400-$178,000." Also mention "This role may also qualify for annual incentive and/or comprehensive benefits." So we have Pay and Benefits sections. No schedule info. We have responsibilities list (multiple bullet-like sentences). We have qualifications/preferred skills list. We need to decide sections: About the role (intro paragraph), Responsibilities (list), Qualifications (list), Skills (maybe combine with qualifications? The instruction includes Skills as possible heading. We have "Qualifications / Preferred Skills" heading in source; we could split into Qualifications and Skills. But we need to preserve all substantive info. Could combine into one section "Qualifications" and include both experience and skills. However they ask to prefer few substantive sections over many thin ones. So maybe we have About the role, Responsibilities, Qualifications (including skills), Pay, Benefits. That's 5 sections. We must not include filler like "commensurate with experience". Not present. We need to remove boilerplate: EEO, accommodation request, etc. Also remove "Sony Pictures Entertainment is an equal opportunity employer..." and the accommodation line. Also remove "To request an accommodation..." etc. Also remove any duplicated lines. The responsibilities list includes repeated lines? Let's extract. Original text: "This role provides leadership and expertise in building, scaling, and continuously improving enterprise Governance, Risk, and Compliance (GRC) programs for Sony Pictures Entertainment and its affiliates. The position is responsible for managing end-to-end cybersecurity and compliance initiatives including PCI DSS, ISO 27001, privacy/security controls, and related security governance frameworks. The role also supports strategic Sony Group information security governance initiatives, including ISMS performance management, policy and standards development, and Sony Group Critical Asset Program. The role partners closely with technical and business stakeholders to lead and coordinate assessments, drive remediation activities, report on program health and risk posture, and improve operational maturity across the organization. A key focus is modernizing and automating control assessment activities through workflow automation, AI-assisted evidence collection, continuous control monitoring, and data-driven reporting to improve efficiency and scalability with limited resources. This individual will also help lead the development, modernization, governance, and rollout of global information security policies, standards, and procedures, ensuring alignment with Sony Group, business operations, evolving technologies, and regulatory requirements. Success in this role requires strong relationship-building skills and the ability to influence teams across Information Technology, Legal, People & Operations (P&O), Privacy, Production Security, and corporate functions. Experience working in fast-paced, creative, or lightly regulated industries such as entertainment, media, gaming, or streaming is highly desirable, where collaboration and influence are critical to driving security and risk reduction outcomes." Then "Responsibilities" heading and list: "Lead and manage enterprise cybersecurity compliance programs including PCI DSS, ISO 27001, privacy/security initiatives, and internal control frameworks. Lead and coordinate end-to-end compliance assessments including scoping, evidence collection, control testing, remediation tracking, and reporting. Partner with control owners and technical teams to assess control effectiveness and drive remediation activities. Develop dashboards, metrics, and executive reporting to communicate compliance status, risk trends, and program maturity. Identify opportunities to automate control assessments, evidence collection, reporting, and governance workflows using AI and automation technologies. Support continuous control monitoring and process improvements to increase operational efficiency and scalability. Develop, maintain, and modernize global information security policies, standards, and procedures. Drive policy governance activities, including stakeholder alignment, periodic reviews, approvals, exception management, and rollout communications. Collaborate with Information Technology, Privacy, Legal, P&O, Production Security, and corporate functions to align security controls and policies with organizational objectives. Support Sony Group information security governance initiatives, including ISMS performance reporting, Sony Group Critical Asset Program activities, and policy and standards development. Serve as a trusted advisor and relationship builder across technical and non-technical stakeholders. Monitor evolving cybersecurity, privacy, and compliance requirements and recommend program improvements." Then "Qualifications / Preferred Skills" list: "5–7+ years of experience in cybersecurity GRC, compliance, risk management, audit, or security program management. Hands-on experience with frameworks such as PCI DSS, ISO 27001, SOC 2, NIST CSF, or related security/privacy standards. Experience leading compliance assessments, remediation management, and control validation activities. Experience developing and operationalizing security policies, standards, and governance processes. Familiarity with GRC and workflow platforms such as ServiceNow, AuditBoard/Optro, Smartsheet, or similar tools. Experience driving automation initiatives related to compliance operations, evidence collection, reporting, or continuous monitoring. Familiarity with AI-enabled workflows and automation technologies to improve operational scale and efficiency. Strong communication, stakeholder management, and relationship-building skills. Ability to operate effectively in fast-paced, evolving environments with competing priorities. Experience in entertainment, media, gaming, or streaming environments is highly desirable. Relevant certifications preferred (CISA, CISM, CRISC, CISSP, ISO 27001, PCI ISA," Then salary line: "The anticipated base salary for this position is $142,400-$178,000. This role may also qualify for annual incentive and/or comprehensive benefits. The actual base salary offered will depend on a variety of factors, including without limitation, the qualifications of the individual applicant for the position, years of relevant experience, level of education attained, certifications or other professional licenses held, and if applicable, the location of the position." We need to keep salary range and mention of annual incentive/comprehensive benefits. We should not include the sentence about actual base salary depending on factors? That's substantive? It's more detail about salary determination; we could keep it as part of Pay section. The instruction: preserve ALL substantive information; do NOT invent or summarize away detail. So we should keep that sentence as well. Thus Pay section: include the salary range and the note about actual base salary depending on factors, plus mention of annual incentive/comprehensive benefits. Benefits section: we have "annual incentive and/or comprehensive benefits". That's vague but it's specific enough? It says "may also qualify for annual incentive and/or comprehensive benefits." That's not a specific list but it's still mention of benefits. We could create Benefits section with that sentence. However we need to avoid filler like "not specified". This is somewhat vague but it's actual content. We'll include. Now About the role: we can use the introductory paragraph(s) before Responsibilities. That's the first big paragraph. We'll put that in

. Now Responsibilities: use

• for each duty. Qualifications: we could combine qualifications and skills into one section, maybe heading "Qualifications". Use
  • for each bullet. We need to ensure we don't repeat content. The qualifications list includes experience, frameworks, etc. We'll keep all. Now output HTML fragment only. Let's craft:

    About the role

    This role provides leadership and expertise in building, scaling, and continuously improving enterprise Governance, Risk, and Compliance (GRC) programs for Sony Pictures Entertainment and its affiliates. The position is responsible for managing end-to-end cybersecurity and compliance initiatives including PCI DSS, ISO 27001, privacy/security controls, and related security governance frameworks. The role also supports strategic Sony Group information security governance initiatives, including ISMS performance management, policy and standards development, and Sony Group Critical Asset Program. The role partners closely with technical and business stakeholders to lead and coordinate assessments, drive remediation activities, report on program health and risk posture, and improve operational maturity across the organization. A key focus is modernizing and automating control assessment activities through workflow automation, AI-assisted evidence collection, continuous control monitoring, and data-driven reporting to improve efficiency and scalability with limited resources. This individual will also help lead the development, modernization, governance, and rollout of global information security policies, standards, and procedures, ensuring alignment with Sony Group, business operations, evolving technologies, and regulatory requirements. Success in this role requires strong relationship-building skills and the ability to influence teams across Information Technology, Legal, People & Operations (P&O), Privacy, Production Security, and corporate functions. Experience working in fast-paced, creative, or lightly regulated industries such as entertainment, media, gaming, or streaming is highly desirable, where collaboration and influence are critical to driving security and risk reduction outcomes.

    Responsibilities

    • Lead and manage enterprise cybersecurity compliance programs including PCI DSS, ISO 27001, privacy/security initiatives, and internal control frameworks.
    • Lead and coordinate end-to-end compliance assessments including scoping, evidence collection, control testing, remediation tracking, and reporting.
    • Partner with control owners and technical teams to assess control effectiveness and drive remediation activities.
    • Develop dashboards, metrics, and executive reporting to communicate compliance status, risk trends, and program maturity.
    • Identify opportunities to automate control assessments, evidence collection, reporting, and governance workflows using AI and automation technologies.
    • Support continuous control monitoring and process improvements to increase operational efficiency and scalability.
    • Develop, maintain, and modernize global information security policies, standards, and procedures.
    • Drive policy governance activities, including stakeholder alignment, periodic reviews, approvals, exception management, and rollout communications.
    • Collaborate with Information Technology, Privacy, Legal, P&O, Production Security, and corporate functions to align security controls and policies with organizational objectives.
    • Support Sony Group information security governance initiatives, including ISMS performance reporting, Sony Group Critical Asset Program activities, and policy and standards development.
    • Serve as a trusted advisor and relationship builder across technical and non-technical stakeholders.
    • Monitor evolving cybersecurity, privacy, and compliance requirements and recommend program improvements.

    Qualifications

    • 5–7+ years of experience in cybersecurity GRC, compliance, risk management, audit, or security program management.
    • Hands-on experience with frameworks such as PCI DSS, ISO 27001, SOC 2, NIST CSF, or related security/privacy standards.
    • Experience leading compliance assessments, remediation management, and control validation activities.
    • Experience developing and operationalizing security policies, standards, and governance processes.
    • Familiarity with GRC and workflow platforms such as ServiceNow, AuditBoard/Optro, Smartsheet, or similar tools.
    • Experience driving automation initiatives related to compliance operations, evidence collection, reporting, or continuous monitoring.
    • Familiarity with AI-enabled workflows and automation technologies to improve operational scale and efficiency.
    • Strong communication, stakeholder management, and relationship-building skills.
    • Ability to operate effectively in fast-paced, evolving environments with competing priorities.
    • Experience in entertainment, media, gaming, or streaming environments is highly desirable.
    • Relevant certifications preferred (CISA, CISM, CRISC, CISSP, ISO 27001, PCI ISA).

    Pay

    The anticipated base salary for