Director, GRC & Information Security

Taft Stettinius & Hollister LLP; Chicago (IL); On-site; USD 180,000 - 240,000; Full time

Job summary

Taft Stettinius & Hollister LLP seeks a Director, Governance, Risk & Compliance to lead the firm’s information security GRC and assurance programs. You will mature governance, risk, and compliance across the organization and align with client, regulatory, and contractual obligations.

Reporting to the CISO, you will coordinate cross-functional governance activities, oversee ISO/IEC 27001 ISMS operations and certification, and drive privacy program initiatives aligned with ISO/IEC 27701.

Qualifications

• Experienced in leading GRC programs for large organizations.
• Strong knowledge of ISO/IEC 27001 and 27701 implementations.
• Proven ability to coordinate across multiple departments and regulatory bodies.

Responsibilities

• Develop and improve the firm's cybersecurity governance, risk, compliance, and assurance program.
• Establish and maintain an integrated control framework aligned with standards, regulatory, contractual, and client requirements.
• Develop annual and multi-year GRC priorities and roadmaps in coordination with the CISO.
• Establish control ownership, evidence requirements, assessment processes, and ongoing compliance monitoring.
• Coordinate governance activities across Information Security, IT, Privacy, Information Governance, Legal, Procurement, Innovation, and business stakeholders.
• Advise the CISO on material compliance gaps, emerging requirements, risk trends, and executive matters.
• Own the day-to-day operation and continual improvement of the ISO/IEC 27001 ISMS.
• Maintain ISO/IEC 27001 certification and coordinate surveillance and recertification activities.
• Manage the Statement of Applicability, control framework, ISMS documentation, and calendar.
• Coordinate internal audits, management reviews, corrective actions, and external certification audits.
• Expand the ISMS scope as technology and business requirements evolve.
• Ensure nonconformities and control deficiencies are documented and remediated.
• Lead implementation and operation of ISO/IEC 27701-aligned Privacy Information Management.

Skills

GRC leadership

Stakeholder management

Regulatory compliance

Information security governance

Tools

ISO 27001

ISO 27701

Job description

Taft Stettinius & Hollister LLP seeks a Director, Governance, Risk & Compliance to lead the firm’s information security GRC and assurance programs. You will mature governance, risk, and compliance across the organization and align with client, regulatory, and contractual obligations.

Reporting to the CISO, you will coordinate cross-functional governance activities, oversee ISO/IEC 27001 ISMS operations and certification, and drive privacy program initiatives aligned with ISO/IEC 27701.