Sr. Information Security GRC Manager

Information Security Fundamentals

Strong understanding of information security principles, frameworks (ISO 27001, NIST CSF, CIS Controls), and financial industry regulations (PCI DSS, SOX, GLBA, GDPR, etc.).

Knowledge of data protection, risk management, identity & access management, and cloud security concepts.

Policy & Procedure Development

Ability to draft, review, and maintain security policies, standards, processes, and guidelines.

Familiarity with policy governance lifecycles, version control, and executive-level communication.

Risk Management & Assessments

Proficiency in risk assessment methodologies and tools.

Experience reviewing and documenting risk exceptions, control gaps, and mitigations.

Ability to translate technical risk findings into business impact language