Global Information Risk & Governance Lead

Mars; Guararema; Presencial; BRL 320 000 - 420 000; Tempo integral

Resumo da oferta

Mars is seeking a Global Information Risk & Governance Lead to manage the end-to-end risk management program and policy lifecycle across the organization. You will lead risk assessments, govern risk identification and remediation, and ensure the development, maintenance, and compliance of security policies and standards.

The role requires 7+ years in Information Security GRC or IT risk, strong communication skills, and expertise in risk frameworks.

Qualificações

• Bachelor’s degree in information security, IT, or equivalent.
• 7+ years of experience in Information Security GRC or IT Risk.

Responsabilidades

• Lead end-to-end Information Security risk assessments and risk reviews.
• Document, assign, and track risk remediation plans with risk owners.
• Apply formal risk rating methodology for consistent prioritization.
• Own the Global Information Security policy and standards lifecycle.
• Ensure regulatory compliance via policy updates.
• Monitor KRIs and KPIs and provide executive-level reporting.
• Drive process improvements across risk management activities.
• Investigate policy exceptions and non-compliance.

Conhecimentos

Risk management

GRC practices

Policy lifecycle

Stakeholder management

Executive communication

Formação académica

Bachelor's degree in information security / IT or related field

Ferramentas

NIST CSF

Descrição da oferta de emprego

Job Description

As the Global Information Risk & Governance Lead, you will manage the end-to-end risk management program and policy lifecycle. In this role, you will lead risk assessments and govern the identification, assessment, and response to security risks. Additionally, you will be responsible for the development, maintenance, and compliance of security policies and standards.

Job Description

As the Global Information Risk & Governance Lead, you will manage the end-to-end risk management program and policy lifecycle. In this role, you will lead risk assessments and govern the identification, assessment, and response to security risks. Additionally, you will be responsible for the development, maintenance, and compliance of security policies and standards.

What will be your key responsibilities?

• Independently lead execution of Information Security risk assessments and business risk reviews.
• Partner with risk owners across the business to document, assign, and track risk remediation plans through their lifecycle.
• Apply formal risk rating methodology to ensure consistent, accurate, and repeatable risk prioritization.
• Embed and support end-to-end risk management services in assigned area of the business (risk identification, assessment, and issue management).
• Deliver comprehensive analysis of risk data to generate actionable insights.
• Drive process optimization by identifying continuous improvement opportunities and leading initiatives from concept to execution.
• Lead and own the Global Information Security policy and standards lifecycle, including initiation, maintenance, and revision.
• Develop and implement processes to ensure organizational compliance by monitoring changes to external regulations and standards, performing periodic gap assessments, and integrating necessary updates into the policy lifecycle.
• Operate the Policy Exception Management Process, aligning with key technical and business teams to evaluate and decide on exception requests using a formal, risk-based approach.
• Execute the policy attestation process and investigate non-compliance.
• Maintain and monitor KRI/KPIs to reflect risk trends, policy compliance, and executive-level reporting.

What are we looking for?

• 1. Education & Professional Qualification
  • Bachelor’s degree in information security, IT, or a similar field, or equivalent work experience
  • 7+ years of experience in Information Security GRC or IT Risk or Governance role
• 2. Knowledge/Experience
  • Technical experience in Risk Management, Issue Management, Information Security, and GRC practices.
  • Strong follow-through, execution, and attention to detail within a complex environment across multiple, diverse stakeholders.
  • Excellent communication, writing, and presentation skills, with a proven ability to create executive-level materials.
  • Familiarity with the NIST Cybersecurity Framework (CSF) or other industry-standard security frameworks.
  • Expertise in business process design and workflow optimization.
  • Proven ability to set and achieve goals and manage multiple projects and priorities.
  • Expertise in leading the full lifecycle of security policies and standards, from creation and stakeholder review to publication and ongoing maintenance.

#TBdigital