Director of GRC

Job Title: Director of GRC

Engagement Type: Temp to Perm

Work Environment: Remote

Certifications: CRISC, CISSP, CISA, CISM or relevant experience

Alcor Solutions is seeking an experienced Director of Compliance to report directly to the Chief Information Security Officer (CISO). The role will be responsible for defining, developing, and implementing a comprehensive compliance framework aligned with the company's business objectives and security requirements.

The Director of Compliance will oversee cybersecurity policy and standards of compliance, ensuring the company adheres to relevant regulations, industry standards, and internal risk management. The ideal candidate will combine expertise in both cybersecurity and risk management disciplines and have exceptional communication and stakeholder management skills.

The Director serves as the primary expert on cybersecurity compliance matters, leads regulatory audits and assessments, drives continuous improvement in governance, risk, and compliance (GRC) processes, and collaborates closely with legal, IT, security operations, internal audit, and executive leadership.

Compliance Strategy and Leadership

• Develop and maintain a comprehensive cybersecurity compliance strategy and roadmap aligned with business goals and evolving threat landscape.
• Manage a team of cyber compliance with direct reports and indirect reports with cross-functional cyber responsibilities.
• Lead a team of cyber specialists, providing direction and supporting their development.
• Provide strategic guidance to the CISO for the representation of risks to the Board, Audit committee, and ERM.

Risk Assessment and Management

• Conduct regular risk assessments, including PCI-DSS, and develop comprehensive risk management plans for various business units and projects.
• Support the identification, evaluation, and prioritization of cyber risks across the organization.
• Conduct risk analysis, providing insights on issues and direction on risk mitigation strategies.
• Vendor Risk Management (VRM): Oversee the VRM program, including ongoing monitoring to manage risks associated with third-party vendors and suppliers.

Regulatory Compliance and Audit

• Ensure regulatory compliance with frameworks in NIST, PCI, SOX, CCPA, HIPAA.
• Support Internal Audit with engagements requiring technology support.
• Maintain the database and reporting platform to ensure compliance with our security policies and standards.

Metrics, Reporting, and Stakeholder Engagement

• Oversee production, reporting and evolution of cyber risk metrics, including Key Performance Indicators (KPIs), scorecards, and Key Risk Indicators (KRIs).
• Engage with a range of senior stakeholders across Lines of Defense to ensure appropriate oversight and reporting of cybersecurity risks and vulnerabilities.
• Collaborate with cross-functional teams on cyber risk remediation activities.
• Drive automation, analytics, and continuous improvement of processes.

Required Qualifications

• Bachelor's degree in information security, Computer Science, or a related field; master's degree preferred.
• Minimum of 10 years of experience in cybersecurity, with a focus on building risk management and compliance organizations.
• Process driven with an extensive knowledge of cyber risk management frameworks and methodologies.
• Proven experience in leadership roles, managing teams, and influencing executive stakeholders.
• Experience in establishing and managing regulatory compliance in NIST, PCI-DSS, SOX, SOC 1/2, CCPA, HIPAA.

Preferred Qualifications

• Relevant certifications such as CISSP, CISM, CRISC or similar.

Key Skills and Competencies

Strategic thinker with a strong understanding of cyber threats, vulnerabilities, and risk mitigation options; innovative thinker and adaptable to change; exceptional communication and presentation skills, capable of translating technical risk into business terms; excellent analytical, problem-solving, and decision-making skills.

Engagement Expectations

• Own cybersecurity policies, standards, governance forums, and the GRC roadmap. Align priorities with business objectives.
• Maintain the cyber risk register, oversee assessments, and establish clear risk owners, treatment plans, and escalation paths. Route risk acceptance to authorized business leaders.
• Coordinate applicable compliance requirements and audits, maintain evidence readiness, and track findings through remediation
• Oversee vendor risk assessments, ongoing monitoring, exceptions, and remediation for critical suppliers.
• Manage and develop the GRC team, prioritize workloads, and coordinate with Security, IT, Legal, Privacy, Procurement, and Internal Audit.
• Present material risks, overdue actions, compliance status, and decisions needed by the CISO and relevant leadership committees.

Success Measures

• Delivers an approved, prioritized GRC roadmap, with owners, milestones, and resource needs.
• Material cybersecurity risks are documented, assessed consistently, and assigned accountable business owners and treatment plans.
• Reduces overdue high-risk findings against an agreed baseline. Closure includes evidence that corrective actions work.
• Required evidence is accurate and available on time. Findings receive clear responses, owners, and remediation dates.
• Priority policies are current, approved, and assigned owners. Exceptions have documented approvals and expiration dates.
• Critical vendors receive appropriate assessments and monitoring. Material vendor issues are tracked and escalated.