The Lead, Information Security GRC Automation joins the Information Security team to strengthen governance capabilities and improve visibility into security risk and policy adoption. In this role, you will build and scale automated control testing, monitoring, telemetry, and evidence collection capabilities to modernize how controls are reported. You will design scalable automation solutions, establish connections across asset and CMDB platforms, and create sustainable frameworks for remediation tracking. Key requirements include deep knowledge of DevOps practices, CI/CD pipelines, and source control. You must have hands-on experience with Azure DevOps and ServiceNow, along with the ability to implement API-based integrations. Proficiency in at least one scripting or programming language is required to troubleshoot integrations and support a data-driven approach to risk and control management across the enterprise.
Design and implement automated control testing, continuous monitoring, and evidence collection capabilities.
Translate control library requirements into scalable automation solutions, metrics, and monitoring routines.
Establish and maintain API-based connections across governance, risk, asset, and technology platforms.
Onboard new evidence sources and improve data quality to enhance traceability across controls and assets.
Develop scalable playbooks, standards, and operational routines to improve consistency in automated monitoring.
Lead the continuous improvement of automation operating models, including intake, prioritization, and reporting workflows.
Review code and troubleshoot integrations to support reusable automation capabilities in production.
What we're looking for
Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Engineering, or a related field, or equivalent practical experience.
Experience engineering security control automation, automated control testing, continuous monitoring, or evidence collection capabilities in complex or regulated environments.
Strong understanding of security controls to interpret intent and translate requirements into technical specifications and acceptance criteria.
Deep knowledge of DevOps practices and delivery pipelines, including CI/CD, source control, testing, release management, and production implementation.
Hands-on experience with Azure DevOps and ServiceNow, including designing workflows and integrating platforms.
Experience defining and implementing API-based integrations between GRC, security, technology, asset, evidence, and reporting platforms.
Working knowledge of software development concepts and at least one scripting or programming language to review code and troubleshoot integrations.
Experience with ServiceNow Integrated Risk Management, continuous controls monitoring, or financial regulatory programs such as SOX or ISO 27001 (preferred).
Power BI
SQL
Microsoft Fabric
Microsoft Power Platform
Power Automate
Power Apps
Claude
Copilot
AWS
ServiceNow
Jira
Data Modeling
Data Governance
Relational Databases
Data Visualization