Job Description - Lead, Cybersecurity GRC Compliance Management

Role Summary

The Lead - Cybersecurity GRC Compliance Management is responsible for leading, governing, and continuously maturing the organization's cybersecurity compliance program. This role provides strategic and operational leadership to ensure compliance with regulatory, legal, and internal cybersecurity requirements through strong governance, control assurance, audit readiness, and risk-based decision-making.

The role acts as a compliance leader and trusted advisor, partnering with Cyber Engineering, IT, Privacy, Legal, Risk Management, and Internal Audit teams to embed compliance by design into technology initiatives and enterprise operations.

Key Responsibilities

Compliance Program Leadership

- Lead enterprise-wide cybersecurity compliance programs aligned to HIPAA, NIST CSF, NIST 800-53, ISO 27001, CIS Benchmarks, PCI-DSS, and SOX

- Define compliance strategy, operating model, and annual roadmap aligned with enterprise risk appetite

- Ensure consistent interpretation and application of regulatory and security requirements across the organization

- Provide leadership oversight for compliance assessments, reviews, and remediation initiatives

Control Assurance & Risk Oversight

- Lead the cybersecurity control lifecycle including control design, implementation guidance, testing, evidence management, and continuous assurance

- Oversee compliance gap assessments and control maturity evaluations across platforms, applications, and infrastructure

- Review high-risk findings, drive prioritization, and ensure effective remediation and closure

- Support risk acceptance and exception decisions with clear articulation of residual risk and business impact

Policy, Standards & Governance

- Own the cybersecurity policy, standards, and procedures lifecycle including creation, review, approval, publication, and periodic refresh

- Ensure policies and standards align with regulatory requirements, industry frameworks, and evolving threat landscapes

- Chair or contribute to governance forums related to compliance, risk, and policy decisions

- Govern cybersecurity policy exceptions and deviations in alignment with formal risk acceptance processes

Audit, Regulatory & Assurance Leadership

- Lead coordination for internal audits, external audits, and regulatory examinations related to cybersecurity compliance

- Serve as the primary liaison between Cybersecurity, Internal Audit, Enterprise Risk, and regulatory stakeholders

- Ensure audit readiness, timely evidence submission, and closure of audit findings

- Drive improvements based on audit outcomes and regulatory feedback

Reporting, Metrics & Continuous Improvement

- Define and present executive-level compliance dashboards, KPIs, and risk metrics for leadership and governance forums

- Track compliance posture, control effectiveness, audit findings, and remediation progress

- Identify systemic compliance gaps, emerging regulatory risks, and improvement opportunities

- Drive automation, tooling enhancements, and process maturity across GRC and compliance functions

Required Skills & Experience

- 5-8+ years of experience in cybersecurity governance, risk, or compliance roles

- Demonstrated experience leading enterprise-scale cybersecurity compliance programs

- Strong knowledge of regulatory and security frameworks including HIPAA, NIST, ISO, PCI, and CIS

- Hands-on experience with audits, regulatory reviews, and control assurance

- Experience with enterprise GRC platforms and workflows (ServiceNow preferred)

- Strong leadership presence with the ability to influence senior stakeholders

- Excellent written and verbal communication skills, including executive reporting

Preferred Qualifications

- Experience in healthcare or other highly regulated industries

- Certifications such as CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer/Auditor

- Experience driving compliance maturity, automation, or transformation initiatives

Key Success Metrics

- Strong and sustainable cybersecurity compliance posture

- Improved audit outcomes and reduction in repeat findings

- Timely closure of high-risk compliance gaps

- Clear executive visibility into compliance and control health

- Mature, scalable, and well-governed compliance operations