Professional, Compliance Lead

What you'll do

• Manage the end-to-end cybersecurity policy and standards program including lifecycle management, annual reviews, and risk acceptances.
• Define and maintain the enterprise cyber risk framework, including taxonomy, scoring models, and risk appetite statements.
• Direct the cyber risk assessment program for applications, infrastructure, business processes, and major change initiatives.
• Oversee the enterprise cyber risk register to ensure data quality, ownership accountability, and timely escalation of risks.
• Develop executive reporting models that translate complex risk and compliance data into actionable narratives for senior leadership.
• Establish and monitor cyber risk metrics and Key Risk Indicators (KRIs) to drive proactive program interventions.
• Lead third-party risk oversight by setting vendor tiering models, assessment standards, and contractual security requirements.
• Serve as the primary point of contact for internal audits, external regulators, and customer security assessments.

What we're looking for

• Must have 6 years of experience in cybersecurity governance, IT risk management, technology compliance, or a related GRC discipline.
• Must demonstrate ownership of a security policy and standards framework including authorship, lifecycle management, and exception handling.
• Must possess advanced knowledge of NIST CSF, NIST 800-53, ISO 27001/27002, and COBIT frameworks.
• Must have experience designing and operating cyber risk assessment methodologies and enterprise risk registers at scale.
• Must have experience defining KRIs and building executive-level risk reporting to drive leadership decisions.
• Must have experience leading third-party cyber risk programs including assessment standards and contract security requirements.
• CISP, CRISC, CISM, or CISA certifications are required or in progress.
• MedTech/Life Sciences background and knowledge of HIPAA, GDPR, and FDA regulations are preferred.