Director, Governance, Risk & Compliance

Taft Stettinius & Hollister LLP; Chicago (IL); On-site; USD 180,000 - 240,000; Full time

Job summary

Taft Stettinius & Hollister LLP seeks a Director, Governance, Risk & Compliance to lead the firm’s information security GRC and assurance programs. You will mature governance, risk, and compliance across the organization and align with client, regulatory, and contractual obligations.

Reporting to the CISO, you will coordinate cross-functional governance activities, oversee ISO/IEC 27001 ISMS operations and certification, and drive privacy program initiatives aligned with ISO/IEC 27701.

Qualifications

• Experienced in leading GRC programs for large organizations.
• Strong knowledge of ISO/IEC 27001 and 27701 implementations.
• Proven ability to coordinate across multiple departments and regulatory bodies.

Responsibilities

• Develop and improve the firm's cybersecurity governance, risk, compliance, and assurance program.
• Establish and maintain an integrated control framework aligned with standards, regulatory, contractual, and client requirements.
• Develop annual and multi-year GRC priorities and roadmaps in coordination with the CISO.
• Establish control ownership, evidence requirements, assessment processes, and ongoing compliance monitoring.
• Coordinate governance activities across Information Security, IT, Privacy, Information Governance, Legal, Procurement, Innovation, and business stakeholders.
• Advise the CISO on material compliance gaps, emerging requirements, risk trends, and executive matters.
• Own the day-to-day operation and continual improvement of the ISO/IEC 27001 ISMS.
• Maintain ISO/IEC 27001 certification and coordinate surveillance and recertification activities.
• Manage the Statement of Applicability, control framework, ISMS documentation, and calendar.
• Coordinate internal audits, management reviews, corrective actions, and external certification audits.
• Expand the ISMS scope as technology and business requirements evolve.
• Ensure nonconformities and control deficiencies are documented and remediated.
• Lead implementation and operation of ISO/IEC 27701-aligned Privacy Information Management.

Skills

GRC leadership

Stakeholder management

Regulatory compliance

Information security governance

Tools

ISO 27001

ISO 27701

Job description

Taft is seeking a Director, Governance, Risk & Compliance to join our team.

We are seeking a Director, Governance, Risk & Compliance to join our team. This role is responsible for leading and maturing the firm’s information security governance, risk, compliance, and assurance programs. All Taft employees operate under a “Client First” philosophy—in all things, we seek to provide exceptional services to our clients.

Duties, Tasks & Responsibilities:

• Develop, operate, and continuously improve the firm's cybersecurity governance, risk, compliance, and assurance program.
• Establish and maintain an integrated control framework aligning applicable standards, regulatory requirements, contractual obligations, and client requirements
• Develop annual and multi-year GRC priorities and roadmaps in coordination with the CISO.
• Establish control ownership, evidence requirements, assessment processes, and ongoing compliance monitoring.
• Coordinate governance activities across Information Security, IT, Privacy, Information Governance, Legal, Procurement, Innovation, and business stakeholders.
• Advise the CISO on material compliance gaps, emerging requirements, risk trends, and matters requiring executive decisions.

ISO/IEC 27001 Information Security Management System

• Own the day-to-day operation and continual improvement of the firm's ISO/IEC 27001 ISMS.
• Maintain ISO/IEC 27001 certification and coordinate surveillance and recertification activities.
• Manage the Statement of Applicability, control framework, control ownership, ISMS documentation, evidence requirements, and certification calendar.
• Coordinate internal audits, management reviews, corrective actions, and external certification audits.
• Expand the scope of the ISMS as the firm's technology environment and business requirements evolve.
• Ensure nonconformities, control deficiencies, and improvement opportunities are documented, assigned, remediated, and validated.

Privacy Governance and ISO/IEC 27701

• Lead implementation and ongoing operation of an ISO/IEC 27701-aligned Privacy Information Management