Security GRC Lead, Gemini

• This leadership role requires strong program management skills, executive-level communication, and the ability to influence across the enterprise
• The ideal candidate will have a proven track record in establishing governance frameworks, developing security policies and processes, and ensuring accountability through effective oversight
• This role demands deep expertise in security governance, including policy creation, governance enforcement, and stakeholder engagement, to ensure the organization consistently adheres to its internal security standards
• This is a full-time leadership position, requiring strategic vision, operational execution, and the ability to mentor and embed governance discipline across the organization
• Bachelor’s degree in cybersecurity, information security, or related field, or equivalent experience
• 8+ years of experience in security governance or related roles in highly regulated industries
• Demonstrated success in establishing governance frameworks, policies, and oversight mechanisms
• Strong knowledge of security frameworks and standards (ISO 27001, NIST CSF, SOC 2, PCI DSS, NYDFS)
• Proven ability to influence senior leadership and drive accountability across departments
• Exceptional communication and presentation skills
• At least one relevant certification: CISSP, CISM, or relevant cyber certification

Desirable

• Gemini is seeking a Security GRC Lead to own and drive the organization’s security governance programs
• The GRC Lead will partner with senior leadership and cross-functional teams to implement and maintain best-in-class governance practices that align with industry frameworks and evolving regulatory expectations
• Lead the Security Governance function, setting vision, priorities, and operating model
• Establish and maintain security policies, standards, and procedures that align with organizational objectives and regulatory frameworks
• Oversee governance forums, steering committees, and working groups to ensure decisions and actions align with governance standards
• Own the lifecycle of security policies and standards, ensuring they are current, practical, and enforceable across the enterprise
• Govern alignment of security controls to established policies and standards, maintaining consistency and accountability
• Provide oversight of control design, implementation, and reporting, while avoiding duplication of compliance team responsibilities
• Lead and execute the enterprise-wide entitlement review process, ensuring proper access governance and accountability
• Own and govern the third-party software assessment and approval process, ensuring consistent enforcement of security requirements
• Integrate data privacy and data protection frameworks (e.g., GDPR, CCPA) into governance processes, ensuring security and privacy are addressed holistically
• Drive process redesign and audit remediation efforts, ensuring governance gaps are closed, controls are strengthened, and improvements are sustainable
• Oversee governance aspects of SOX 404 IT General Controls (ITGC), including access management, change management, and audit readiness
• Operate effectively in a fast-paced, dynamic environment, managing multiple priorities and stakeholders simultaneously while maintaining governance discipline
• Partner with engineering, IT, and business units to ensure security governance is embedded into projects, processes, and technology modernization
• Serve as the governance authority in architecture and program reviews, ensuring accountability for security decisions
• Support third-party governance by overseeing the application of policies to vendor security and contractual obligations
• Define governance metrics, reporting, and dashboards to measure the maturity and effectiveness of security governance
• Present governance outcomes, decisions, and escalations to executive leadership
• Act as a trusted advisor to senior leaders on governance priorities and risk-informed decision-making
• Champion a security governance culture that emphasizes accountability, transparency, and continuous improvement
• Mentor stakeholders and team members on governance best practices
• Represent the governance function in regulatory, audit, and external forums as required