Sr Cybersecurity Governance, Risk and Compliance Manager

Is it surprising to hear that a financial institution of 1.5 million members and over $30 billion in managed assets say that success comes from focusing on people, not profits?

Our “people helping people” philosophy has guided us since 1935, driving our deep commitment to serving our members, communities, and each other. When you join our team, you become part of a purpose-driven organization where your work makes a real difference.

While we’re proud of our history, we’re even more excited about our future. With business and technology transformation on the horizon, there’s never been a better time to be part of BECU.

You bring more than your expertise to your role, and that matters here. Your story, perspectives, and lived experiences help shape belonging at BECU and deepen how we connect with and support our employees, our members, and our communities.

PAY RANGE

The Target Pay Range for this position is $156,200.00-$190,800.00 annually. The full Pay Range is $121,200.00 - $225,800.00 annually. At BECU, compensation decisions are determined using factors such as relevant job-related skills, experience, and education or training. Should an offer for employment be made, we will consider individual qualifications. In addition to your salary, compensation incentives are available for the hired applicant. Incentives are performance based and targets vary by role.

BENEFITS – because people helping people starts with supporting you

• 401(k) Company Match (up to 3%)

• 4% annual contribution to your 401(k) by BECU

• Medical, Dental and Vision (family contributions as well)

• PTO Program + Exchange Program

• Tuition Reimbursement Program

• BECU Cares volunteer time off + donation match

IMPACT YOU’LL MAKE:

As a Senior Cybersecurity Governance, Risk and Compliance (GRC) Manager, you’ll play a key role in strengthening how BECU protects its members, information, and financial assets through effective cybersecurity governance and control oversight. You’ll help shape and mature our cybersecurity governance program, translating frameworks and regulatory expectations into practical standards, controls, and scalable ways of working across the organization. As a senior individual contributor, you’ll help establish second-line cybersecurity control oversight, advance Continuous Control Monitoring (CCM), and partner with teams to identify and remediate control gaps. You’ll also have an opportunity to modernize GRC through AI, automation, reporting, and connected workflows that reduce manual effort and provide better visibility into cybersecurity risk. Your expertise and ability to influence across cybersecurity, technology, Compliance, and emerging AI governance will help strengthen BECU’s security and resilience.

To join our dynamic team, we require candidates to be residents of WA, OR, ID, AZ, TX, GA, SC, NC, CA or VA. If you’re located in Washington state and within a reasonable driving distance from Tukwila, we are requesting that you come into our HQ on Tuesdays & Wednesdays. For those candidates that live outside the commute distance of TFC and in any of our approved remote work locations, this role will be remote. Remote or onsite, we are committed to ensuring you are fully engaged and included in our collaborative environment.

WHAT YOU’LL DO:

• Shape Cybersecurity Governance: Partner with Cybersecurity leadership to develop, evolve, and continuously improve GRC programs, processes, standards, guidelines, and supporting disciplines.
• Advance Control Oversight: Help establish and mature second-line oversight of BECU’s cybersecurity control framework, providing credible challenge and partnering with first-line control and solution owners to identify gaps, clarify ownership, and drive remediation.
• Support Regulatory Readiness: Partner with Enterprise Compliance and other stakeholders to support cybersecurity-related regulatory examinations, including engagements involving the NCUA and Washington State DFI, coordinating evidence, responses, findings, and remediation as appropriate.
• Operationalize Cybersecurity Frameworks: Translate cybersecurity frameworks, regulatory expectations, and evolving requirements into practical standards, guidelines, control expectations, and operating practices stakeholders can apply across the organization.
• Build Continuous Control Monitoring: Help advance Continuous Control Monitoring capabilities by connecting cybersecurity requirements with automated monitoring, control-gap identification, issue management, remediation workflows, dashboards, and reporting.
• Modernize GRC Through Automation: Identify opportunities to reduce repetitive manual work using workflow automation, integrations, AI-enabled capabilities, and technologies such as Power BI, Power Automate, and the broader Microsoft Power Platform.
• Strengthen Cybersecurity Maturity: Use established cybersecurity frameworks and assessment results to identify opportunities for improvement, develop actionable plans, and help advance cybersecurity maturity across the enterprise.
• Drive Risk and Control Remediation: Interpret cybersecurity information and processes to identify potential control or framework compliance issues, engage accountable owners, provide effective oversight, and escalate concerns when appropriate.
• Develop Metrics and Reporting: Create and maintain meaningful cybersecurity performance and risk metrics, dashboards, and reporting that provide leaders and control owners with visibility into control health, remediation, ownership, and progress.
• Influence Across the Enterprise: Build trusted relationships across cybersecurity, technology, Enterprise Compliance, enterprise architecture, IAM, AI governance, and other teams, using your expertise and influence to move complex initiatives forward without relying on direct authority.
• Support Responsible AI Governance: Represent cybersecurity perspectives in AI governance efforts and help translate cybersecurity and risk-management expectations into practical requirements for the responsible adoption of emerging technologies.
• Evolve Standards and Guidelines: Adapt BECU cybersecurity standards and guidelines in response to changes in technology, organizational needs, regulatory expectations, and the evolving threat landscape, including supporting cybersecurity governance considerations associated with PCI.
• Share Knowledge: Help stakeholders understand cybersecurity governance expectations and contribute to awareness and education that make complex technical and business requirements easier to understand and act upon.
• Contribute Where Needed: Perform other duties as assigned in support of BECU’s cybersecurity governance, risk, compliance, and control objectives.

This isn’t just about ticking off tasks on a list. It's about making a significant, positive change in BECU’s journey, where your contributions are valued, and your growth is continually fostered.

WHAT YOU’LL GAIN:

• Opportunity to Build: Help shape a developing second-line cybersecurity control-oversight capability rather than simply stepping into a fully established program.
• Modern GRC Experience: Play a meaningful role in advancing Continuous Control Monitoring and connecting policies, controls, automated monitoring, remediation, and reporting into a more integrated operating model.
• AI and Automation Exposure: Explore practical uses for AI, workflow automation, Power Platform capabilities, and emerging governance-as-code and policy-as-code approaches to make GRC work more efficient and scalable.
• Enterprise-Level Influence: Work across cybersecurity, technology, Compliance, architecture, IAM, AI governance, and other functions on initiatives with broad organizational visibility.
• Regulatory and Framework Depth: Expand your experience with financial-services cybersecurity examinations and frameworks such as NIST CSF, FFIEC guidance, and other relevant governance and compliance requirements.
• Meaningful Member Impact: Help strengthen the safeguards, oversight, and cybersecurity practices that protect member information and financial assets and contribute to a secure and resilient BECU.
• Strategic Ownership: Operate as a highly visible senior individual contributor with room to combine strategic thinking, hands-on program development, stakeholder influence, and continuous improvement.

QUALIFICATIONS:

Minimum Qualifications:

• Typically requires a Bachelor’s degree in Information Security, Computer Science or related field, or equivalent work or education-related experience. Advanced degree preferred.
• Typically requires 7 years of cybersecurity experience or related experience in IT, Compliance, or Audit.
• Expertise leveraging established GRC frameworks, such as Federal Financial Institutions Examination Council (FFIEC) guidance, Graham Leach Bliley Act (GLBA) controls, Payment Card Industry Data Security Standard (PCI/DSS) controls, Sarbanes- Oxley (SOX), NIST CSF and other relevant laws and regulations; especially in the use of frameworks to increase cybersecurity maturity capabilities and its application in an enterprise environment required.

Desired Qualifications:

• One or more of the following certifications, or equivalent certifications, preferred: CISSP, CCSP, CISM, GIAC, CISA, CRISC, or PCI-related certifications, including PCIP, ISA, or QSA.
• Demonstrated ability to collaborate and influence stakeholder and partner organizational leadership and management, including vendors and third parties required.
• Working knowledge of governance, risk, and compliance (GRC) tools and automation of risk evaluation, integration with enterprise risk functions, and reporting required.
• Understanding of information and security systems to identify risk exposure, including third party-related cyber risk.
• Ability to work independently, and as a team member, while using discretion in decision making and sound judgment in problem solving.
• Ability to set goals and objectives pertaining to training needs and lesson plans, effectively present programs, and provide training materials to individuals and groups.
• Working knowledge of the role of firewalls, vulnerability management, penetration testing, server and desktop configuration and controls, and encryption.
• Demonstrated ability to share knowledge and assist others in understanding technical and business topics.

JOIN THE JOURNEY

Ready to make an indelible impact? Eager to be a part of a collaborative and innovative team where your ideas and contributions don’t just fill a role, but fuel the growth and success of BECU?

EEO Statement:

BECU is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, veteran status, disability, sexual orientation, gender identity, or any other protected status.