Security Governance and Compliance Manager

Security Governance and Compliance Manager New York New York Job ID: 21275 Security Governance, Risk & Compliance (GRC) Manager Reporting to the Director of Information Security, the GRC Manager will play a critical role in advancing the firm’s security, compliance, and risk management programs. This is a highly visible individual contributor position that serves as the primary liaison for client security assessments, manages the firm’s ISO 27001/27701 programs, and drives key governance and compliance initiatives across the organization. Key Responsibilities Client Security Assessments Serve as the primary point of contact for client security questionnaires, audits, RFPs, and Outside Counsel Guidelines. Manage responses, evidence collection, findings remediation, and stakeholder coordination. Maintain and optimize the firm’s Vanta-based questionnaire automation and evidence repository. ISO 27001 / ISO 27701 Program Management Coordinate internal and external audits, annual risk assessments, and compliance activities. Partner with external consultants and internal stakeholders to maintain certification requirements. Track continuous improvement initiatives and compliance metrics. Governance, Risk & Compliance Develop and maintain security policies, procedures, and control frameworks. Support oversight of privileged access management, vulnerability management, data protection, and security compliance initiatives. Provide regular reporting and recommendations to IT leadership and firm management. Security Awareness & Training Manage phishing simulations and cybersecurity awareness programs. Update training content to reflect emerging threats, regulatory changes, and firm policies. Qualifications Bachelor’s degree in Information Security, Information Systems, Risk Management, or related field. 5+ years of experience managing enterprise GRC programs, including ISO 27001 and/or SOC 2 environments. Strong knowledge of security frameworks, risk management, audits, and compliance programs. Experience handling client security assessments and third-party audits. Excellent communication, documentation, and stakeholder management skills. Relevant certifications such as CISSP, CISA, CRISC, PMP, or similar are highly preferred. Why Join? Highly visible role with direct exposure to firm leadership. Opportunity to shape and mature a world-class security and compliance program. Collaborative, team-oriented environment within a premier global law firm. Exposure to cutting-edge cloud, AI, and information security initiatives. Flexible hybrid work model and strong long-term career growth potential. #J-18808-Ljbffr