Vice President, IT Governance, Risk & Compliance
Northwestern Mutual · Milwaukee, WI · 1 mo ago
Information Technology$220k/yrFull-time
We need to output HTML fragment with sections: About the role? The posting includes Summary, Primary Duties & Responsibilities (with subsections), Qualifications (Required, Preferred), Compensation Range (Pay Range). Also benefits: "Flexible work schedules Concierge service Comprehensive benefits Employee resource groups". Also maybe "Grow your career..." but that's fluff.
We must not repeat job title as heading. Use for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only if posting has real specific content.
We have content for About the role (the Summary). Responsibilities (Primary Duties & Responsibilities). Qualifications (Required Qualifications, Preferred Qualifications). Benefits (Flexible work schedules etc). Pay (Compensation Range). Schedule? Not mentioned; no schedule specifics. So we should not include Schedule heading.
Skills? Not explicit separate; maybe we could embed skills in Qualifications. But we could have a Skills section if there is content; but not needed.
We must use
for section headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We need to include sections only if posting has real specific content.
We have content for About the role (the Summary). Responsibilities (Primary Duties & Responsibilities). Qualifications (Required Qualifications, Preferred Qualifications). Benefits (Flexible work schedules etc). Pay (Compensation Range). Schedule? Not mentioned; no schedule specifics. So we should not include Schedule heading.
Skills? Not explicit separate; maybe we could embed skills in Qualifications. But we could have a Skills section if there is content; but not needed.
We must use - for any list of duties/requirements/benefits. Use
for prose.
We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. The posting includes "We believe in fairness and transparency..." etc. That's not boilerplate? It's about compensation transparency; we can keep as part of Pay section maybe. Also "Grow your career..." is fluff but maybe keep as part of About? It's not boilerplate but could be considered marketing; but we should preserve substantive info. It's not required to remove marketing fluff unless it's boilerplate. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we keep marketing fluff.
We must not include Job ID/requisition numbers.
We need to output only HTML fragment, no /, no markdown fences.
Let's structure:
About the role
Summary text...
Responsibilities
- Strategic Leadership: ... (maybe break into subpoints? Could keep as one li with multiple sentences? Better to split each bullet as per duties.)
We have many duties under headings: Strategic Leadership, Governance & Risk Management, Regulatory Compliance & Audit, Technology & Cybersecurity Leadership, Modernization, Automation & AI, Executive & Board Engagement.
We could create li for each heading with its content.
Similarly for Qualifications: Required Qualifications and Preferred Qualifications.
We could have
Qualifications
then - Required: ...
- Preferred: ...
but that loses detail. Better to have subheadings? But only allowed headings are those listed; we cannot add custom headings like Required Qualifications. However we could embed required and preferred within li text.
But we must preserve all substantive information; we can include paragraphs inside li? Probably okay to have inside li? Not typical but allowed. Simpler: Use
- for each bullet point; we can split each duty into separate li.
Let's extract duties:
Strategic Leadership:
- Develop and execute a multi-year vision and strategy for the IT GRC organization aligned with enterprise objectives, technology strategy, and cybersecurity priorities.
- Transform traditional compliance and risk management practices into a modern, data-driven operating model emphasizing automation, scalability, and continuous monitoring.
- Build a high-performing organization that attracts, develops, and retains top talent across governance, compliance, risk management, and regulatory disciplines.
- Partner closely with Cybersecurity, Technology, Enterprise Risk Management, Internal Audit, Legal, Privacy, and business leadership to ensure integrated risk management across the enterprise.
Governance & Risk Management:
- Oversee enterprise IT governance frameworks, policies, standards, controls, and risk management processes.
- Ensure effective identification, assessment, measurement, monitoring, and reporting of technology and cybersecurity risks.
- Drive maturation of risk management capabilities through improved metrics, analytics, and automation.
- Develop meaningful executive and board-level reporting that translates technical risks into business and financial impacts.
Regulatory Compliance & Audit:
- Lead compliance efforts related to applicable technology and cybersecurity regulations and standards.
- Maintain readiness for regulatory examinations and external reviews.
- Serve as the primary executive sponsor for technology and cybersecurity audits, examinations, and regulatory engagements.
- Establish sustainable and defensible compliance practices that withstand both regulatory and audit scrutiny.
- Drive remediation of audit findings and regulatory concerns through risk-based prioritization and measurable outcomes.
Technology & Cybersecurity Leadership:
- Provide strategic oversight for technology and cybersecurity governance programs.
- Partner with cybersecurity leadership to assess and manage emerging threats, control effectiveness, security maturity, and operational risk.
- Apply practical cybersecurity experience to improve governance and risk outcomes rather than relying solely on theoretical compliance models.
- Maintain awareness of evolving threat landscapes, technology trends, cloud risks, AI-related risks, and cybersecurity regulations.
Modernization, Automation & AI:
- Champion modernization of IT GRC practices through automation, workflow orchestration, advanced analytics, and data-driven decision making.
- Lead the adoption of continuous assurance capabilities that reduce manual evidence collection and repetitive compliance activities.
- Drive elimination of duplicate processes and fragmented controls across governance, risk, and compliance programs.
- Establish governance frameworks and oversight mechanisms for emerging AI technologies and AI-enabled business processes.
- Foster a culture that embraces innovation while maintaining appropriate risk management and regulatory compliance.
Executive & Board Engagement:
- Serve as a trusted advisor to the CISO, CIO, executive leadership team, and governance committees.
- Deliver concise, compelling, and actionable briefings to senior executives, board committees, auditors, and regulators.
- Translate complex technical, cyber, and regulatory issues into language appropriate for executive and board audiences.
- Build strong relationships across the organization to influence decision making and achieve strategic outcomes.
Now Qualifications Required:
- A cybersecurity leader who understands governance and compliance, not simply a compliance leader who understands regulations.
- A technology strategist who understands how platforms, integrations, automation, and AI enable scalable risk management.
- 15+ years of progressive leadership experience across IT governance, risk management, compliance, audit, cybersecurity, or technology management.
- Demonstrated experience leading large-scale enterprise programs within a highly regulated environment.
- Strong understanding of information technology, cybersecurity architectures, cloud technologies, identity and access management, data protection, and technology operations.
- Extensive experience managing regulatory compliance programs and interactions with internal and external auditors.
- Proven experience presenting to executive leadership teams, board committees, regulators, and auditors.
- Demonstrated success developing enterprise-wide governance, risk, compliance, or cybersecurity programs.
- Exceptional executive communication, influencing, and relationship management skills.
Preferred Qualifications:
- Experience within the insurance industry strongly preferred.
- Experience within financial services, banking, wealth management, or other highly regulated industries.
- Prior leadership experience in a cybersecurity discipline such as cyber defense, security engineering, identity and access management, security architecture, incident response, risk management, or security operations.
- Experience implementing or leading modern GRC platforms and technology-enabled compliance programs.
- Experience leading large-scale compliance transformations, automation initiatives, or digital modernization programs.
- Knowledge of emerging AI governance, model risk management, and technology ethics practices.
- Professional certifications such as CISSP, CISM, CRISC, CGEIT, CISA, CPA, CIA, or equivalent.
Compensation:
Pay Range - Start: $220,000.00
Pay Range - End $330,000.00
This role is eligible for additional short-term and long-term incentive compensation.
We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.
We should not include the "click here to learn more" link? It's a reference; maybe we can keep as text but it's a link; but we can't include actual link? We can keep as plain text "click here to learn more". It's not boilerplate; it's part of compensation description.
Benefits:
Flexible work schedules
Concierge service
Comprehensive benefits
Employee resource groups
We can make a Benefits section with ul li each.
Schedule: none.
Now produce HTML.
We need to ensure we don't repeat job title as heading. Not using.
Let's craft.
We'll start with
About the role
... summary text ...
Summary text: "We are seeking an experienced, forward-thinking Vice President of IT Governance, Risk & Compliance (IT GRC) to lead and transform the enterprise IT GRC function. This executive leader will be responsible for establishing and advancing a modern, technology-enabled governance, risk, compliance, and regulatory response program that supports the company mission, protects customers, and enables business growth. This role requires an exceptional leader who can operate at the intersection of cybersecurity, technology, risk management, audit, regulation, and business strategy. The successful candidate will possess deep knowledge of cybersecurity and technology risks, extensive experience within highly regulated industries, and a demonstrated ability to build scalable programs leveraging automation, data intelligence, continuous assurance, and artificial intelligence. The Vice President will serve as a trusted advisor to executive leadership, regulators, auditors, and business stakeholders while driving a culture of accountability, transparency, and risk-informed decision making across the enterprise."
That's the summary.
Now Responsibilities heading with ul li each duty.
We'll need to keep the subheadings? Could embed them as part of li text.
Let's produce li for each bullet as above.
Qualifications heading: we could have two sub-sections: Required Qualifications and Preferred Qualifications as h4? Not allowed. Could just have two paragraphs: Required Qualifications:
then ul li each. But we must not invent headings not allowed? Using is okay. The instruction only restricts headings to those specific ones; using other tags like or is fine.
Thus:
Qualifications
Required Qualifications:
- ...
...
Preferred Qualifications:
- ...
...
Benefits:
Benefits
- Flexible work schedules
- Concierge service
- Comprehensive benefits
- Employee resource groups
Pay:
Pay
Pay Range - Start: $220,000.00
Pay Range - End: $330,000.00
This role is eligible for additional short-term and long-term incentive compensation.
We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.
We should not include Schedule.
Now ensure we didn't include any boilerplate like EEO etc. The posting includes "Northwestern Mutual is an equal opportunity employer..." that's EEO boilerplate; we must remove. Also "FIND YOUR FUTURE..." and "We’re excited about the potential people bring..." etc. That's marketing but not boilerplate; but maybe it's
for prose. We need to preserve all substantive information, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. The posting includes "We believe in fairness and transparency..." etc. That's not boilerplate? It's about compensation transparency; we can keep as part of Pay section maybe. Also "Grow your career..." is fluff but maybe keep as part of About? It's not boilerplate but could be considered marketing; but we should preserve substantive info. It's not required to remove marketing fluff unless it's boilerplate. The instruction: Remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. So we keep marketing fluff. We must not include Job ID/requisition numbers. We need to output only HTML fragment, no /, no markdown fences. Let's structure:
About the role
Summary text...
Responsibilities
- Strategic Leadership: ... (maybe break into subpoints? Could keep as one li with multiple sentences? Better to split each bullet as per duties.)
We have many duties under headings: Strategic Leadership, Governance & Risk Management, Regulatory Compliance & Audit, Technology & Cybersecurity Leadership, Modernization, Automation & AI, Executive & Board Engagement.
We could create li for each heading with its content.
Similarly for Qualifications: Required Qualifications and Preferred Qualifications.
We could have
Qualifications
then- Required: ...
- Preferred: ... but that loses detail. Better to have subheadings? But only allowed headings are those listed; we cannot add custom headings like Required Qualifications. However we could embed required and preferred within li text. But we must preserve all substantive information; we can include paragraphs inside li? Probably okay to have
- for each bullet point; we can split each duty into separate li.
Let's extract duties:
Strategic Leadership:
- Develop and execute a multi-year vision and strategy for the IT GRC organization aligned with enterprise objectives, technology strategy, and cybersecurity priorities.
- Transform traditional compliance and risk management practices into a modern, data-driven operating model emphasizing automation, scalability, and continuous monitoring.
- Build a high-performing organization that attracts, develops, and retains top talent across governance, compliance, risk management, and regulatory disciplines.
- Partner closely with Cybersecurity, Technology, Enterprise Risk Management, Internal Audit, Legal, Privacy, and business leadership to ensure integrated risk management across the enterprise.
Governance & Risk Management:
- Oversee enterprise IT governance frameworks, policies, standards, controls, and risk management processes.
- Ensure effective identification, assessment, measurement, monitoring, and reporting of technology and cybersecurity risks.
- Drive maturation of risk management capabilities through improved metrics, analytics, and automation.
- Develop meaningful executive and board-level reporting that translates technical risks into business and financial impacts.
Regulatory Compliance & Audit:
- Lead compliance efforts related to applicable technology and cybersecurity regulations and standards.
- Maintain readiness for regulatory examinations and external reviews.
- Serve as the primary executive sponsor for technology and cybersecurity audits, examinations, and regulatory engagements.
- Establish sustainable and defensible compliance practices that withstand both regulatory and audit scrutiny.
- Drive remediation of audit findings and regulatory concerns through risk-based prioritization and measurable outcomes.
Technology & Cybersecurity Leadership:
- Provide strategic oversight for technology and cybersecurity governance programs.
- Partner with cybersecurity leadership to assess and manage emerging threats, control effectiveness, security maturity, and operational risk.
- Apply practical cybersecurity experience to improve governance and risk outcomes rather than relying solely on theoretical compliance models.
- Maintain awareness of evolving threat landscapes, technology trends, cloud risks, AI-related risks, and cybersecurity regulations.
Modernization, Automation & AI:
- Champion modernization of IT GRC practices through automation, workflow orchestration, advanced analytics, and data-driven decision making.
- Lead the adoption of continuous assurance capabilities that reduce manual evidence collection and repetitive compliance activities.
- Drive elimination of duplicate processes and fragmented controls across governance, risk, and compliance programs.
- Establish governance frameworks and oversight mechanisms for emerging AI technologies and AI-enabled business processes.
- Foster a culture that embraces innovation while maintaining appropriate risk management and regulatory compliance.
Executive & Board Engagement:
- Serve as a trusted advisor to the CISO, CIO, executive leadership team, and governance committees.
- Deliver concise, compelling, and actionable briefings to senior executives, board committees, auditors, and regulators.
- Translate complex technical, cyber, and regulatory issues into language appropriate for executive and board audiences.
- Build strong relationships across the organization to influence decision making and achieve strategic outcomes.
Now Qualifications Required:
- A cybersecurity leader who understands governance and compliance, not simply a compliance leader who understands regulations.
- A technology strategist who understands how platforms, integrations, automation, and AI enable scalable risk management.
- 15+ years of progressive leadership experience across IT governance, risk management, compliance, audit, cybersecurity, or technology management.
- Demonstrated experience leading large-scale enterprise programs within a highly regulated environment.
- Strong understanding of information technology, cybersecurity architectures, cloud technologies, identity and access management, data protection, and technology operations.
- Extensive experience managing regulatory compliance programs and interactions with internal and external auditors.
- Proven experience presenting to executive leadership teams, board committees, regulators, and auditors.
- Demonstrated success developing enterprise-wide governance, risk, compliance, or cybersecurity programs.
- Exceptional executive communication, influencing, and relationship management skills.
Preferred Qualifications:
- Experience within the insurance industry strongly preferred.
- Experience within financial services, banking, wealth management, or other highly regulated industries.
- Prior leadership experience in a cybersecurity discipline such as cyber defense, security engineering, identity and access management, security architecture, incident response, risk management, or security operations.
- Experience implementing or leading modern GRC platforms and technology-enabled compliance programs.
- Experience leading large-scale compliance transformations, automation initiatives, or digital modernization programs.
- Knowledge of emerging AI governance, model risk management, and technology ethics practices.
- Professional certifications such as CISSP, CISM, CRISC, CGEIT, CISA, CPA, CIA, or equivalent.
Compensation:
Pay Range - Start: $220,000.00
Pay Range - End $330,000.00
This role is eligible for additional short-term and long-term incentive compensation.
We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.
We should not include the "click here to learn more" link? It's a reference; maybe we can keep as text but it's a link; but we can't include actual link? We can keep as plain text "click here to learn more". It's not boilerplate; it's part of compensation description.
Benefits:
Flexible work schedules
Concierge service
Comprehensive benefits
Employee resource groups
We can make a Benefits section with ul li each.
Schedule: none.
Now produce HTML.
We need to ensure we don't repeat job title as heading. Not using.
Let's craft.
We'll start with
About the role
... summary text ...
Summary text: "We are seeking an experienced, forward-thinking Vice President of IT Governance, Risk & Compliance (IT GRC) to lead and transform the enterprise IT GRC function. This executive leader will be responsible for establishing and advancing a modern, technology-enabled governance, risk, compliance, and regulatory response program that supports the company mission, protects customers, and enables business growth. This role requires an exceptional leader who can operate at the intersection of cybersecurity, technology, risk management, audit, regulation, and business strategy. The successful candidate will possess deep knowledge of cybersecurity and technology risks, extensive experience within highly regulated industries, and a demonstrated ability to build scalable programs leveraging automation, data intelligence, continuous assurance, and artificial intelligence. The Vice President will serve as a trusted advisor to executive leadership, regulators, auditors, and business stakeholders while driving a culture of accountability, transparency, and risk-informed decision making across the enterprise." That's the summary. Now Responsibilities heading with ul li each duty. We'll need to keep the subheadings? Could embed them as part of li text. Let's produce li for each bullet as above. Qualifications heading: we could have two sub-sections: Required Qualifications and Preferred Qualifications as h4? Not allowed. Could just have two paragraphs:Required Qualifications:
then ul li each. But we must not invent headings not allowed? Using is okay. The instruction only restricts headings to those specific ones; using other tags likeor is fine. Thus:
Qualifications
Required Qualifications:
- ... ...
Preferred Qualifications:
- ... ...
Benefits
- Flexible work schedules
- Concierge service
- Comprehensive benefits
- Employee resource groups
Pay
Pay Range - Start: $220,000.00
Pay Range - End: $330,000.00
This role is eligible for additional short-term and long-term incentive compensation.
We believe in fairness and transparency. It’s why we share the salary range for most of our roles. However, final salaries are based on a number of factors, including the skills and experience of the candidate; the current market; location of the candidate; and other factors uncovered in the hiring process. The standard pay structure is listed but if you’re living in California, New York City or other eligible location, geographic specific pay structures, compensation and benefits could be applicable, click here to learn more.
We should not include Schedule. Now ensure we didn't include any boilerplate like EEO etc. The posting includes "Northwestern Mutual is an equal opportunity employer..." that's EEO boilerplate; we must remove. Also "FIND YOUR FUTURE..." and "We’re excited about the potential people bring..." etc. That's marketing but not boilerplate; but maybe it's
inside li? Not typical but allowed. Simpler: Use