Director, Governance

Riot Platforms, Inc.; United States; Remote; USD 180,000 - 280,000; Full time

Benefits offered by this job

Competitive Salary

Long-Term Growth

401(k) Retirement Plan

Comprehensive Health Coverage

Wellness & Lifestyle Perks

Job summary

Riot Platforms, Inc. is seeking a Director, Governance to shape and own our foundational GRC infrastructure, including policy library, ISO 27001 documentation, contracts management, and third-party risk.

You will partner with Legal, Procurement, HR and Operations to drive policy adoption and align governance with SOC 2, ISO 27001, and NIST CSF across Riot's critical assets.

Qualifications

• Progressive GRC and governance experience in regulated environments.
• Experience building policy libraries and governance models.
• Ability to design and drive cross-functional programs.

Responsibilities

• Own ISO 27001:2022 documentation framework and policy lifecycle.
• Establish governance model spanning SOC 2, SOX, and enterprise policy needs.
• Lead horizon scanning and translate signals into GRC actions.
• Stand up Contracts Management with Legal co-ownership and clear sign-off gates.
• Develop Third-Party Risk Management and vendor risk programs.
• Map policies to SOC 2, ISO 27001, and NIST CSF for unified audits.
• Coordinate with Legal, Procurement, HR, and Operations to drive adoption.

Skills

GRC leadership

Policy management

Regulatory affairs

Governance program design

Cross-functional collaboration

Policy library development

Education

ISO 27001 Lead Implementer certification

Job description

About the role

The Director, Governance owns the foundational infrastructure every other GRC pillar depends on. Without a policy library, Compliance has nothing to test. Without regulatory horizon scanning, risk finds Riot before Riot finds risk. Without a contracts management program, vendor and third-party risk runs unchecked. Governance is the bedrock of this program — and this role builds it from near zero in Year 1.

This pillar is intentionally scoped to govern, not to test or audit. Governance owns the full lifecycle of policies and standards: drafting, approval routing, versioning, publication, and attestation tracking. Governance owns the ISO 27001:2022 documentation framework — all mandatory policy and procedure documents required for certification. Governance owns the regulatory radar, the Contracts Management program (in co-ownership with Legal), and the Third-Party Risk Management program (in partnership with Procurement).

You will report to the Senior Director, GRC and maintain a co-ownership relationship with the Chief Legal Officer on Contracts Management, where Legal holds final sign-off authority at every material decision gate. In critical operations, you will engage mining site and data center leadership to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the enterprise governance framework.

What you’ll do

• Build and own the ISO 27001:2022 documentation framework: identify and produce all mandatory policies, procedures, and records required for certification, map them to Annex A controls, and drive adoption through executive sponsorship and attestation programs — this is the Year 1 priority with a contractually fixed delivery timeline.
• Build and operate the Riot policy and standards library from near-zero baseline: establish the governance model (drafting, review routing, approval gates, versioning, renewal cadences), and extend scope beyond ISO 27001 to cover SOC 2, SOX, and enterprise policy requirements.
• Own the regulatory horizon scanning program: monitor developments across critical infrastructure, digital assets, data privacy, and financial services; translate regulatory signals into GRC program actions; and deliver regular briefings to the Sr. Director and executive leadership.
• Stand up the Contracts Management program in co-ownership with Legal: design the intake-to-repository workflow, establish GRC risk flagging criteria (data processing, liability, security, regulatory), and implement the Legal sign-off gate — Legal approves, GRC operates.
• Own the Third-Party Risk Management (TPRM) and vendor risk program: build the vendor tiering model, define due diligence requirements by tier, partner with Procurement on intake integration, and establish ongoing monitoring cadences for critical and colocation vendors.
• Manage the GRC framework lifecycle: maintain Riot’s mapping of policies and controls to SOC 2 Trust Services Criteria, ISO 27001, NIST CSF, and applicable regulatory frameworks — keeping the library current as the regulatory and audit environment evolves.
• Engage critical operations to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the governance framework and aligned to enterprise GRC standards.

What you’ll bring

• 8–12+ years of progressive GRC, policy management, regulatory affairs, or governance program experience at a publicly traded or highly regulated company.
• ISO 27001 Lead Implementer certification — required. The Director, Governance is the primary owner of ISO 27001:2022 policy and documentation implementation. Riot has an active, contractually required certification obligation; this credential is a baseline requirement, not a differentiator.
• Demonstrated experience building a policy library from a minimal baseline — governance model design, framework mapping, attestation program rollout, and cross-functional adoption.
• Experience standing up or operating a Contracts Management program with Legal co-ownership — contract risk review, DPA requirements, and GRC-Legal governance models.
• Working knowledge of TPRM frameworks and vendor risk program design — tiering models, due diligence questionnaires, and ongoing monitoring processes.
• Proven regulatory horizon scanning capability across critical infrastructure, digital assets, and data privacy (CISA, FinCEN, state privacy laws, DORA, NIS2 familiarity).
• Experience mapping a policy library to multiple frameworks simultaneously (SOC 2, ISO 27001, NIST CSF) to support a unified audit and control program.
• Strong cross-functional communication and influence: ability to drive policy adoption and contracts governance across Legal, Procurement, HR, and Operations without direct authority.
• Preferred: CISM, CGEIT, CRISC, or CIPP/US certification; experience in critical infrastructure, energy, data center, or digital asset environments.

Compensation and Benefits

• Competitive Salary: Base range (commensuratewith experience) + bonus + sign-on equity grant.

• Long-Term Growth: Eligible toparticipatein Riot’s equity incentive programs and share in the success you help build.

• 401(k) Retirement Plan: Incudes a generous company match.

• Comprehensive Health Coverage: Multiple medical plan options, including 100% company-paid plans.

• Wellness & Lifestyle Perks: Enjoy free gymmemberships, pet insurance, childcare discounts, and more to support your life both in and out of work.

Riot is an equal opportunity employer. We are committed to creating an inclusive environment for all employees.