Manager, Information Security Governance, Risk & Compliance (GRC)

Location: Remote, United States

About the Company

Our client is a large, established financial services organization undergoing significant technology, cybersecurity, and risk transformation. The organization operates within a highly regulated environment and is investing in modern governance, risk, compliance, and cybersecurity assurance capabilities to strengthen enterprise controls, regulatory readiness, and information security risk management. The organization offers a highly collaborative environment where senior leaders have the opportunity to influence enterprise security strategy, regulatory compliance, technology risk, assurance practices, and the continued maturation of the broader Information Security organization.

Job Summary

We are looking for a Manager, Information Security Governance, Risk & Compliance (GRC) to provide strategic and operational leadership across cybersecurity assurance, governance, controls, regulatory compliance, and technology risk. This individual will lead a team while owning and advancing critical assurance capabilities across a highly regulated enterprise environment. The ideal candidate will combine deep GRC and cybersecurity controls expertise with strong people leadership, executive presence, regulatory experience, and the ability to personally engage in complex assurance and control activities when needed. The Manager will work across Information Security, Technology, Risk, Audit, Legal, Compliance, and business leadership, establishing sustainable governance and assurance practices while improving control effectiveness, audit readiness, regulatory alignment, and measurable risk outcomes.

Key Responsibilities

• GRC & Assurance Strategy: Establish and execute a multi-year vision and roadmap for information security governance, risk, compliance, controls, and assurance capabilities.
• Cybersecurity Controls: Design, assess, test, document, and remediate IT general controls (ITGCs), application-level controls, and cybersecurity controls across complex enterprise environments.
• PCI DSS Compliance: Provide leadership across PCI DSS environments, including scope definition, control design, testing, remediation, evidence management, and interaction with QSA/ISA stakeholders.
• Regulatory & Framework Alignment: Apply frameworks and regulatory requirements including NYDFS Part 500, NIST Cybersecurity Framework, CIS Controls, and PCI DSS to enterprise security and control environments.
• Audit & Regulatory Readiness: Partner directly with internal and external auditors, regulators, and business stakeholders to explain and defend control design, risk decisions, remediation strategies, and supporting evidence.
• GRC Technology & Automation: Advance the use of GRC platforms and automation to improve control monitoring, assurance testing, evidence collection, audit readiness, and overall program efficiency.
• People Leadership: Lead, coach, develop, and manage information security and assurance professionals through performance management, workforce planning, stretch assignments, and structured talent development.
• Executive & Stakeholder Communication: Communicate complex cyber