Senior Manager, Information Security Governance, Risk & Compliance (GRC)

Location: Pittsburgh, PA (preferred); New York City, NY; or San Francisco Bay Area, CA

Job Type: Full-time, Permanent

Work Arrangement: Hybrid, 3 days onsite per week

About the Opportunity

PostMilitary is recruiting on behalf of a global enterprise technology company seeking an experienced Information Security Governance, Risk & Compliance (GRC) leader.

This is an opportunity to take ownership of an established global GRC program, lead an international team, and help shape how a growing enterprise technology organization manages cybersecurity risk, compliance, and customer security expectations.

The ideal candidate has experience owning and advancing a comprehensive GRC program, rather than specializing exclusively in one compliance discipline.

This role reports directly to the Chief Information Security Officer (CISO) and offers significant responsibility for the continued development and maturity of the organization's global information security program.

This position involves access to technology subject to U.S. export-control laws. Candidates must meet applicable export-control requirements, and eligibility will be verified during the hiring process

Depending on experience, candidates may be considered at the Senior Manager or Director level.

Key Responsibilities

Global GRC Leadership

• Own and lead the organization's end-to-end information security governance, risk, and compliance program.
• Establish strategic priorities, develop roadmaps, and drive measurable improvements across the GRC function.
• Lead and develop an established team of approximately 4–5 security professionals distributed internationally.
• Work closely with the CISO and security leadership to align GRC initiatives with organizational objectives.

Cybersecurity Frameworks and Compliance

• Lead compliance programs, audits, and certification activities across multiple frameworks, including FedRAMP, IRAP, ISO 27001, SOC 1/SOC 2, PCI DSS, HIPAA, and applicable NIST standards.
• Manage framework implementations, ongoing certifications, audit readiness, evidence collection, and remediation.
• Develop and maintain an effective, unified approach to security controls across multiple regulatory environments.
• Ensure compliance programs support the needs of commercial and public-sector customers globally.

Enterprise Risk and Security Governance

• Oversee enterprise information security risk assessments, risk registers, mitigation plans, and executive reporting.
• Develop and maintain cybersecurity policies, standards, and governance processes.
• Oversee third-party risk management, vendor security assessments, and security awareness initiatives.
• Partner with IT, engineering, application security, and infrastructure security teams to address risks and control gaps.

Customer and Business Engagement

• Work directly with enterprise customers and prospective customers to explain security controls, architecture, and compliance commitments.
• Partner with Sales, Customer Success, and Legal to address security questionnaires, contractual obligations, and customer security requirements.
• Translate complex technical and regulatory requirements into practical business decisions.
• Build trust with internal stakeholders and external customers while balancing security expectations with business needs.

Continuous Improvement and Automation

• Identify opportunities to improve GRC efficiency through automation, AI, and continuous monitoring.
• Advance the organization toward proactive, near-real-time compliance monitoring rather than relying exclusively on periodic audits.
• Develop KPIs and reporting mechanisms to measure program performance and effectiveness.
• Improve customer security review processes, evidence management, and internal compliance workflows.

Required Qualifications

• 7+ years of experience leading information security GRC programs, including compliance certifications, security risk management, and audit activities.
• 3+ years of direct people-management experience.
• Demonstrated accountability for multiple areas of an enterprise GRC function, rather than exclusive ownership of a single compliance specialty.
• Direct experience leading security framework implementations, compliance initiatives, or certifications through meaningful stages of execution.
• Strong understanding of major cybersecurity frameworks, including NIST SP 800-53, FedRAMP, ISO 27001, SOC 2, and related standards.
• Experience managing enterprise information security risks, governance policies, audit remediation, and third-party security requirements.
• Ability to communicate security architecture, risks, and regulatory requirements to technical and nontechnical audiences.
• Experience working with senior executives, cross-functional teams, and external stakeholders.
• Ability to independently manage priorities, lead initiatives, and operate effectively within a collaborative, lean security organization.
• Ability to work onsite three days per week in one of the designated office locations.
• Current authorization to work in the United States without employer sponsorship.

Preferred Qualifications

• Experience leading GRC programs within a global enterprise software, SaaS, or cloud technology organization.
• Direct responsibility for FedRAMP authorization, IRAP assessments, or comparable technically rigorous compliance programs.
• Experience implementing and managing cybersecurity frameworks across multiple countries or regulatory environments.
• Demonstrated success building, transforming, or significantly maturing enterprise GRC programs.
• Experience leading geographically distributed teams.
• Familiarity with automation, AI-assisted compliance, or continuous control monitoring.
• Bachelor's degree in a related field or equivalent professional experience.

What Success Looks Like

Within the first six months, the successful candidate will be expected to:

• Establish a clear understanding of the existing global GRC program and its priorities.
• Maintain ongoing compliance commitments and customer security obligations.
• Identify opportunities to strengthen and unify security control management.
• Develop a practical roadmap for more proactive, continuous compliance monitoring.
• Identify opportunities to automate manual GRC and customer security processes.
• Introduce or improve measurable KPIs for program effectiveness, risk reduction, and operational efficiency.

Why Consider This Opportunity?

• Direct partnership with the CISO and meaningful ownership of the global GRC function.
• An established international team to lead and develop.
• Opportunity to shape the future of cybersecurity governance across a global enterprise technology environment.
• Exposure to complex international regulatory requirements and enterprise customers.
• Ability to influence how AI, automation, and continuous monitoring are incorporated into modern GRC operations.
• Long-term professional growth within the information security organization.

The hiring organization offers a competitive compensation and benefits package, including medical, dental, vision, and additional benefits.

About PostMilitary

PostMilitary connects experienced professionals with career opportunities aligned with their expertise, priorities, and long-term goals.

We are supporting this search on behalf of a confidential client. The selected candidate will be employed directly by the hiring organization, not PostMilitary.

Our recruiting approach emphasizes thoughtful conversations, transparency, and ensuring the opportunity is a strong fit for both the candidate and the organization.

Professionals from all backgrounds are welcome to apply. Military service is not required.

Qualified applicants will be contacted to discuss their experience, career interests, and potential alignment with the opportunity.

Job Type: Full-time

Pay: $175,000.00 - $208,000.00 per year

Benefits:

• 401(k)
• Dental insurance
• Health insurance
• Paid time off
• Retirement plan
• Vision insurance

Application Question(s):

• Have you accumulated at least 3 years of experience directly managing employees, including responsibility for their performance, development, and day-to-day work?
• Are you able to work onsite at least 3 days per week in Pittsburgh, PA; New York City, NY; or the San Francisco Bay Area, CA?
• Have you been directly accountable for an organization's entire Information Security GRC program, or have you primarily led individual functions within it (such as compliance, audits, enterprise risk, or third-party risk)? Briefly describe the scope of your responsibilities and your level of ownership.

Work Location: Hybrid remote in Pittsburgh, PA 15205