Cyber Governance & Assurance Leader

Geico

Palo Alto (CA)

On-site

USD 120,000 - 260,000

Full time

6 days ago

Be an early applicant

Application generator

Stand out for this role — generate a tailored resume and cover letter in about a minute.

Get past ATS filters

Job summary

GEICO in Palo Alto, CA seeks Senior Manager of Cyber Governance & Assurance to lead enterprise cybersecurity governance, shaping policies, standards and control programs across Cybersecurity and Technology.

You will translate regulatory requirements into actionable controls, drive risk-based remediation, and partner with Legal, Privacy, Risk, Internal Audit, and Engineering to embed compliance into development and operations.

Qualifications

7+ years of progressive experience in cybersecurity governance, risk and compliance, including at least 5 years leading teams and enterprise programs.
Experience establishing or maturing governance and compliance capabilities in large, complex, multi-cloud and hybrid environments.
Strong working knowledge of application security frameworks and standards such as ISO 27001, NIST 800-series, NY DFS, CPPA/CPRA, PCI DSS, NIST CSF, SOX is valuable as applicable to assigned scope.
Experience overseeing cybersecurity audits or regulatory examinations and coordinating control remediation with accountable owners.
Experience with strategic planning, program roadmaps, priorities and resource allocation

Responsibilities

Own and mature the Cyber Governance operating model, including governance forums, establishing clear decision rights, roles and responsibilities, accountability and escalation paths across Cybersecurity and Tech.
Advise senior leaders on cybersecurity governance, regulatory obligations and material cyber risk; present clear option, recommendations and decisions required.
Lead the cybersecurity policy, standard and control lifecycle from development, and stakeholder review through approval, publication and periodic refresh.
Translate regulatory and cybersecurity requirements into actionable technology standards, controls and engineering requirements.
Ensure cyber security exceptions and acceptances do not introduce aggregated risk and address root cause of cyber systemic exceptions.
Identify systemic control failures to identify root causes and partner with accountable owners to drive enterprise level remediation.
Establish governance for the cybersecurity controls, including ownership, design expectations, evidence requirements, effectiveness monitoring, deficiencies and remediation oversight, hold implementation owners accountable.
Drive control rationalization and harmonization across regulatory frameworks to reduce duplicative controls and create a common enterprise control framework.
Partner with Technology and Engineering teams to embed compliance requirements and automated controls into engineering workflows and the software development cycle.
Define cybersecurity governance KPIs, KRIs and compliance metrics covering compliance posture, control health, remediation progress and emerging risks.
Lead the development and delivery of monthly and quarterly business reviews, translating cybersecurity governance performance, compliance posture, emerging risks and strategic initiatives into executive-level insights, recommendations and actionable decisions.
Partner with Enterprise Risk and accountable risk owners to maintain accurate cyber risk records, escalation material exposure and oversee treatment commitments.
Set governance requirements and priorities for continuous compliance monitoring and automation across multi-cloud and data center environments, partner with engineering teams responsible for delivery.
Manage all cyber issues to closure.
Build, mentor and lead a high-performing governance function, with clear priorities, ownership, coaching, while fostering a culture of accountability, innovation and continuous improvement.
Lead monthly, quarterly annual priorities, resource planning, change adoption and performance management; establish an inclusive, accountable team culture and develop team members.
Influence cross-functional stakeholders, constructively challenge proposed risk decisions and lead complex discussions to resolution without relying on direct authority.