Governance, Risk and Compliance Manager, Lumivero

• Our ideal candidate has experience in supporting cybersecurity, risk management, and compliance in the SaaS space
• They must be an effective collaborator who can communicate easily across the organizition, able to adapt to technical acumen of their audience
• This person should be experienced with third party audit projects in a cloud-centric environment, particularly SOC 2
• We're also looking for someone who can think strategically and drive a company culture dedicated to effective risk management and cybersecurity
• 5+ years of IT audit and compliance programs experience in a global organization with in-depth knowledge and experience of cybersecurity frameworks such as ISO 27001, SOC 2, NIST CSF, and other regulatory requirements
• Experience in supporting third-party audit projects in a cloud-centric environment, with a strong aptitude to understand emerging technologies to assure regulatory and compliance requirements are met
• Experience collaborating closely with security partners, including incident response, architects and engineers to seamlessly incorporate cybersecurity controls and risk management processes into their day-to-day operations
• Excellent written communication skills with the ability to document, communicate, and report security assessments as well as the status of the implementation and effectiveness of cybersecurity controls with product and business leaders
• Ability to communicate with all levels of the organization from C level executives to individual contributors
• Strong project management skills with the ability to lead and execute security assessment projects and initiatives on time with multiple stakeholders

Desirable

• We're looking for an experienced Governance, Risk, and Compliance (GRC) Manager to join our team!
• The GRC Manager will lead Lumivero's technology risk management program
• They will own our response to cybersecurity issues, ensure regulatory alignment with data privacy and and information security standards, and foster a company culture or proactive risk management
• This role is full-time, Exempt, and fully remote in the USA. It reports to the Vice President, Enterprise IT and Applications
• Lead the Lumivero technology risk management program, providing risk oversight to the Lumivero DevOps, R&D, IT and HR teams
• Own the organization's response to cybersecurity issues identified through various inputs, including, but not limited to, control gaps, external and internal audits, and incidents
• Coordinate Lumivero’s collective responses to customer information security questions and requests
• Provide strategic guidance to information-security stakeholders, fostering a culture of proactive risk management, sound decision-making, and critical-issues management planning
• Manage and own all remediation and report on the progress of finding closure activities
• Lead risk management initiatives to ensure regulatory alignment to SOC 2, HIPAA, TX RAMP, and other data-privacy and information-security standards
• Implement policies, procedures, standards, and controls to govern the protection of corporate information systems, networks, and data
• Partner and engage with departments across the organization, including CISO, IT, R&D, Legal, HR, Accounting and Finance, educating and advocating for compliance considerations and adherence to internal policies
• Make an impact on the organization’s security program and services through experience with various cybersecurity concepts and frameworks including data governance, risk management, metrics, audit, policy, and standards development
• Act as liaison with internal and external auditors for regulatory audits/assessments, facilitating meetings, walkthroughs, and discussion of remediation activities for identified deficiencies
• Support in the execution of the general data privacy assessment processes (including third-party assessments), internal control reviews, and risk assessments to monitor compliance with IT and cybersecurity policies/standards
• Maintain our security and compliance trust management platform, Vanta