Manager, IT Governance, Risk & Compliance

About The Institutes

Located in beautiful Malvern, Pennsylvania, The Institutes® are a not-for-profit comprised of diverse affiliates that educate, elevate, and connect people in the essential disciplines of risk management and insurance. Through products and services offered by our nearly 20 affiliated business units, people and organizations are empowered to help those in need with a focus on understanding, predicting, and preventing losses to create a more resilient world. Additionally, we understand the importance of work-life balance—in 2026 Philly.com named us a Top Workplace for the eleventh year and USA Today named us a USA Top Workplace for the fourth year. We provide excellent benefits and a friendly, team-focused work environment to drive employee engagement.

Essential Responsibilities

• Assure alignment of the enterprise security program to NIST CSF 2.0: set the control baseline, review and sign off on control implementation and maturity assessments, and maintain the remediation roadmap for unimplemented controls, with execution by engineering teams and managed services.
• Direct and assure daily cybersecurity operations through the managed detection and response (MDR) relationship: hold the provider to defined service levels; review alert triage, escalation, threat intelligence, and vulnerability management outputs; and sign off on remediation closure.
• Serve as the primary point of accountability for incident response governance: ensure security incidents are investigated end to end by the MDR partner and engineering leadership, and sign off on incident documentation, after-action reviews, and improvement actions.
• Serve as the primary point of accountability for the Third-Party Risk Management (TPRM) program: maintain vendor tier classifications and risk profiles; review and distribute security questionnaires; collect and analyze SOC reports, cyber insurance documentation, and compliance artifacts; track vendor remediation items to closure; and research vendor markets to surface emerging risks and trends — coordinating execution across staff, managed services, and platform workflows.
• Lead AI and third-party risk analysis: conduct AI-focused vendor risk assessments covering model usage, training data sources, and data retention practices; maintain an AI risk scoring methodology; assess model risk exposure (bias, explainability, regulatory considerations); detect and mitigate Shadow AI usage; track vendor data exposure and data-sharing pathways; and operate TPRM/AI governance platform workflows (e.g., OneTrust).
• Coordinate contractual data governance risk review in partnership with General Counsel: evaluate AI/data-related clauses in vendor contracts — data ownership, data residency, model training rights, sub-processor disclosures, and AI indemnification and liability language — and provide risk review during vendor onboarding and renewals in partnership with the IT portfolio function.
• Provide vendor risk analytics