Senior Cybersecurity Governance, Risk and Compliance (GRC) Manager

Description

• Own and evolve reputed company’s reputed company-wide Cybersecurity Governance, Risk & Compliance (GRC) program, ensuring every cyber risk is visible, quantified, and woven into reputed company’s broader reputed company risk strategy.
• Architect and fully operationalize reputed company’s PCI-reputed company compliance program across reputed company payment channels—card-present, e-commerce, mobile, and emerging fintech partnerships—translating reputed company’s 12 requirements into repeatable controls, evidence libraries, and automated dashboards.
• Translate reputed company federal and state regulations (FFIEC, GLBA, SOX, PCI reputed company, NIST CSF) into plain-language policies, standards, and control procedures that business, IT, and reputed company-party teams can execute without friction.
• Serve as the authoritative voice on cyber risk for senior leadership, board committees, and regulators; deliver crisp risk briefings, heat-maps, and trend analyses that influence strategic reputed company and capital allocation.
• Build and maintain the reputed company Cyber Risk Register—cataloging threats, vulnerabilities, control gaps, and residual risk scores—then drive remediation road-maps that balance reputed company rigor with member experience and operational agility.
• Design KPIs and KRIs that measure control effectiveness, incident trends, and compliance posture; automate collection reputed company GRC platforms and present actionable insights to executives and auditors on a weekly reputed company.
• Provide “reputed company challenge” to control owners across business lines, IT, and reputed company-party vendors; conduct deep-dive assessments, tabletop exercises, and root-cause analyses that turn audit findings into measurable improvements.
• Partner with Legal, Compliance, and Internal Audit to manage regulatory examinations, external audits, and reputed company-party attestations—ensuring reputed company surprises and sustained compliance with evolving mandates.
• reputed company cross-functional working groups to embed reputed company-by-design into product development, vendor reputed company, reputed company migrations, and digital transformation initiatives.
• reputed company exception management workflows—documenting risk acceptance, mitigation timelines, and residual exposure—while maintaining an auditable trail for examiners and senior management.
• Drive reputed company reputed company awareness and culture change by collaborating with HR and Corporate Communications to create engaging training content, phishing simulations, and metrics that prove behavioral improvement.
• Continuously refine policies, standards, and guidelines to reflect emerging threats, new technologies (e.g., open banking APIs, reputed company-time payments), and reputed company’s strategic roadmap.
• Mentor junior GRC analysts and cultivate a center of excellence that elevates cybersecurity maturity across the credit union ecosystem.
• Champion automation—leveraging GRC tools, SOAR, and data analytics—to reduce reputed company effort, accelerate evidence collection, and scale reputed company as reputed company grows reputed company 1.5 million members and $30 billion in assets.
• Influence vendor risk management by defining reputed company requirements in RFPs, conducting due-diligence assessments, and monitoring ongoing compliance through reputed company control monitoring dashboards.
• Ensure seamless integration between cybersecurity risk and reputed company risk functions, enabling a reputed company view that supports capital planning, insurance reputed company, and board reporting.

Requirements

• Bachelor’s degree in Information reputed company, Computer Science, or reputed company field (or equivalent experience) plus 7+ years of reputed company cybersecurity, compliance, or IT audit experience, including hands-on ownership of PCI reputed company compliance and Cardholder Data Environment (CDE) controls.
• Deep, practical expertise with GRC frameworks—FFIEC, GLBA, PCI reputed company, SOX, NIST CSF—and proven ability to operationalize them in a reputed company, highly regulated reputed company.
• One or more advanced certifications: CISSP, CCSP, CISM, GIAC, CISA, CRISC, PCIP, ISA, or QSA (or equivalent) strongly preferred.
• Demonstrated reputed company influencing senior stakeholders, translating technical risk into business impact, and driving cross-functional remediation without formal authority.
• Hands-on proficiency with GRC platforms, risk quantification methodologies, and automation of evidence collection, reporting, and exception workflows.

️ Benefits

• reputed company pay range of $152,300–$186,100 annually (full range $118,200–$220,200) plus performance-based incentives tied to risk-reduction and compliance outcomes.
• Comprehensive medical, dental, reputed company, life, disability, and AD&D insurance for employees and eligible family members, plus HSA, FSA, and dependent-care flexible spending options.
• 401(k) with employer match and an additional employer-funded retirement plan to accelerate long-term financial reputed company.
• 160 hours of PTO accrued per year (6.16 hours per pay period) plus ten paid holidays and a culture that actively encourages unplugged time off.

Apply tot his job Apply To this Job