Requirements
Manage and deliver GRC projects impacting enterprise-scale software products subject to regulatory requirements including HIPAA, CCPA, GDPR, FedRAMP and ISO 27000 series and SOC audits.
Coordinate with cross-functional stakeholders across security, engineering, legal, compliance, privacy, and internal audit teams to ensure on-time completion of projects and initiatives.
Create, maintain and update control documentation, standard operating procedures, and compliance artifacts in accordance with organizational standards.
Assist in the implementation and ongoing management of enterprise GRC tools and workflows.
Create, Manage and track project plans, project milestones, compliance metrics and risk indicators; prepare reports and dashboards for senior leadership and governance committees.
Partner with product and engineering teams to integrate security and privacy requirements into Software/System development lifecycles (SDLC).
Ensure readiness for internal and external audits through structured planning, documentation management, and stakeholder engagement.
Monitor regulatory and framework updates, escalating impacts, and coordinating required changes across the organization.
Preferences
Bachelor’s degree along with PMP certification required or advanced academic degree in Project Management.
4–6 years of experience in GRC, IT compliance, risk management, or security-focused project/program management within an enterprise organization.
Demonstrated experience supporting compliance and governance initiatives involving PHI, PII; federal frameworks such as FedRAMP and the use of AI across business functions.
Working knowledge of audit and certification processes, including SOC 2 and ISO 27001.
Familiarity with enterprise control frameworks (ISO 27000 series, NIST, etc.).
Experience managing projects with defined methodologies (e.g., Agile, Waterfall, or hybrid approaches).
Experience with tools and leveraging AI to complete tasks (i.e., Smartsheet, MS Project/SharePoint, ADO, etc).
Strong organizational skills with the ability to manage multiple concurrent workstreams in a structured environment.
Excellent communication and stakeholder management skills, experience navigating complex organizational structures.
Experience operating within cloud-based enterprise environments (e.g., AWS, Azure)
Familiarity with privacy program operations, including DPIAs.
Ability to interpret regulatory requirements and map them to technical and operational controls.
Experience supporting audit interactions with external auditors and internal audit functions in a structured environment.
Security certification(s) from ISC2, SANS, Offensive Security, TCM Security, ISACA, other known certification authority.
