Director, Security Governance, Risk and Compliance

About the role

The Director of Security Governance, Risk and Compliance sits within Information Security and reports to the Chief Information Security Officer. The role leads a team overseeing security governance, risk, compliance, customer trust and privacy, and works with Legal, Sales, HR and other teams to reduce business risk and support the company's global growth strategy. It is a strategic leadership role with a strong hands-on component.

Key responsibilities

• Lead and manage a global team, owning security policies, procedures and controls and compliance with applicable regulations.
• Develop and run a comprehensive information security risk management program, including risk strategy, self-assessment and analysis.
• Manage M&A due diligence, train and raise awareness, and oversee data governance, product certification and compliance.
• Configure and maintain GRC tools, collaborate with Privacy Counsel on ISO 27701 certification, lead security audits and refine policies.
• Support sales and marketing with certification roadmaps, compliance reporting and customer-facing security messaging.
• Create and manage a security M&A due diligence plan, and use AI and technology to reduce compliance overhead.
• Work with marketing on the effort and ROI of new certifications, and partner with engineering, product and customer teams on compliant processes.

Required profile

• 10+ years in Governance, Risk and Compliance or a related field, with 3-5 years in a leadership or managerial position.
• Extensive experience managing security policies, procedures and controls in complex, highly regulated environments.
• Proven track record leading audits, risk management programs, incident response and data governance.
• Comfortable working with individual contributors and presenting to senior leadership, and with external stakeholders such as CTOs, CISOs and procurement VPs.
• U.S. work authorization without sponsorship; the role is not eligible for employer-sponsored visas.

Required skills

• Knowledge of GDPR, HIPAA, SOC 2, ISO 27001, ISO 27701, ISO 9001, ISO 42001, DORA, NIST and the Secure Controls Framework.
• Preferred: GxP/FDA/ICH, FedRamp/FISMA, SOX, LogicGate administration, and certifications such as CISA, CISM, CRISC, CISSP, CIPP/e/us, HIPAA & HITECH.

What we offer

• Flexible working hours with no core time and a hybrid environment.
• Market-competitive salary, annual performance-based bonus and 401(k).
• Full benefits package, including medical and dental coverage, disability and life insurance, and company-paid holidays, PTO and volunteer days.
• Career path and professional development.