Director, Information Security Governance, Risk, and Compliance (GRC)

PenFed Credit Union; McLean (VA); Hybrid; USD 122,000 - 284,000; Full time

Job summary

PenFed Credit Union seeks a Director, Information Security Governance, Risk, and Compliance (GRC) in a hybridTysons, VA setting. You will translate strategy into risk-based priorities, guide teams, and drive DRL responses, risk assessments, and remediation across the enterprise.

You will lead GRC efforts, coordinate with Legal, Internal Audit, and IT, and manage risk reporting to senior leadership with strong collaboration and influence.

Qualifications

• Master’s Degree and/or bachelor’s degree in computer science or related field preferred.
• Minimum of ten (10) years of relevant Information Security risk management experience.
• Proven experience leading, coaching, and developing teams in a complex security, risk, or compliance environment.
• Experience with security controls in large financial services organizations.
• Familiarity with NIST 800-53, NIST CSF, ISO 27001/2; knowledge of governance frameworks.

Responsibilities

• Lead and execute the Information Security risk management program across the organization.
• Perform risk assessments, RCSAs, and document risk conclusions clearly.
• Maintain and mature security risk frameworks, policies, and standards.
• Oversee third‑party information security risk management activities.
• Develop and report risk & compliance metrics and dashboards to leadership.
• Serve as primary contact for NCUA examinations and audits; manage DRLs and remediation.

Skills

Leadership

Strategic communication

Stakeholder management

Information security risk management

Education

Master’s degree in Computer Science or related field

CISSP, CISA, CISM, CRISC certifications

Tools

Archer

ServiceNow GRC

Job description

Director, Information Security Governance, Risk, and Compliance (GRC)

PenFed is hiring a (Hybrid) Director, Information Security Governance, Risk, and Compliance (GRC) at our Tysons, Virginia location. The primary purpose of this role is to operationalize and execute the enterprise Information Security Governance, Risk, and Compliance (GRC) strategy established by the VP, Information Security Risk and Governance. The Director translates strategic direction into priorities, work plans, team guidance, and hands‑on risk and compliance activities to ensure high-quality, timely outcomes. This role serves as the primary Information Security point of contact for NCUA examinations and audits; coordinates work across Information Security, Technology, Enterprise Risk, Internal Audit, Legal, and business teams; and is accountable for the quality and timely completion of Document Request List (DRL) responses, findings, exceptions, risk assessments, control activities, and remediation commitments. The Director balances leadership with direct operational involvement to strengthen the organization’s security posture and enable consistent, risk‑based decision‑making.

Equivalent combination of education and experience is considered.

• Master’s Degree and/or bachelor’s degree in computer science or equivalent in related field preferred.
• Minimum of ten (10) years of relevant Information Security risk management experience.
• Proven experience leading, coaching, and developing teams while establishing priorities, driving accountability, and delivering high-quality outcomes in a complex Information Security, risk, or compliance environment.
• Experience in the management of security control capabilities within large, complex financial services organization.
• Solid working knowledge of understanding key security controls (Access Control, Encryptions, etc.)
• Ability to communicate effectively and influence Business and IT leadership, staff, and other stakeholders, company-wide, to implement security recommendations.
• Ability to establish and develop effective, trusting relationships with internal business units, together with a proven knowledge of the methods necessary to assess information security within a large organization.
• Experience with risk management tracking tools (e.g., Archer, ServiceNow GRC, or similar platforms) to document risks, monitor remediation progress, maintain control inventories, and deliver accurate, data‑driven risk reporting.
• Experience in formal risk assessment and risk management practice.
• Strong familiarity with information security, risk management, and IT government standards and frameworks (e.g. NIST 800-53, NIST Cyber Security Framework, ISO 27001/2, etc.)
• Experience using AI tools preferred.

Supervisory Responsibility

This position will supervise employees.

Licenses and Certifications

CISSP, CISA, CISM, CRISC, etc.

Work Environment

While performing the duties of this job, the employee is regularly exposed to an indoor office setting with moderate noise.

Most roles require working in an office setting with moderate noise and the ability to lift 25 pounds.

Travel

Ability to travel to various worksites and be on call is required.

Pay Transparency

The anticipated starting salary range for this role is $121,800.00 - $283,648.00

This position is eligible for an organizational performance based annual bonus, subject to board discretion and approval.

This position is eligible for an individual performance based annual bonus.

Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions. This is not intended to be an all-inclusive list of job duties, and the position will perform other duties as assigned.

• Lead and actively execute the Information Security risk management program, including identifying, assessing, analyzing, monitoring, and reporting risks and working directly with stakeholders to define appropriate treatment and remediation actions.
• Perform and oversee detailed Information Security risk assessments, including Risk and Control Self-Assessments (RCSAs); review work completed by team members; and clearly document risk conclusions.
• Execute and operationalize security risk management strategies and frameworks established by Enterprise Risk Management. Maintain and mature security risk frameworks, policies, and standards that guide consistent, enterprise‑wide information security risk management practices.
• Oversee third‑party Information Security risk management activities, including the vendor security risk assessments, risk analysis, issue escalation, risk acceptance, remediation follow‑up, and ongoing monitoring.
• Lead and actively support Information Security control management, including maintaining the control inventory, mapping controls to risks, confirming ownership, improving control documentation, coordinating assessments and testing, evaluating gaps, and monitoring remediation to strengthen control design and operating effectiveness.
• Lead, coach, and develop the Information Security GRC team, including providing hands‑on guidance, reviewing and improving work products, clarifying expectations, removing barriers, and directly contributing to complex or time‑sensitive work. Establish clear priorities and accountability while building the capabilities of team members with varying levels of experience.
• Develop, maintain, validate, and report risk and compliance metrics, dashboards, and key performance and risk indicators. Ensure supporting information is complete and accurate, identify overdue commitments, and provide execution status, risk insights, and escalation recommendations to the VP, Information Security Risk and Governance and other stakeholders as appropriate.
• Prepare, review, and deliver clear, accurate, and timely risk and compliance reporting for senior leadership, regulators, the Cyber Risk Management Council, and the Board of Directors.
• Serve as the primary Information Security point of contact for NCUA examinations and audits and support other internal and external reviews. Lead the collection, review, organization, submission, and tracking of materials responsive to Document Request Lists (DRLs); coordinate contributors and dependencies across teams; ensure responses are complete, accurate, consistent, and delivered on time; and manage Information Security findings, exceptions, remediation plans, commitments, and closure evidence.
• Manage the execution, review, communication, and modernization of Information Security policies, standards, and procedures in alignment with VP direction, enterprise objectives, regulatory expectations, risk appetite, and the broader governance framework.
• Maintain deep awareness of emerging technologies, industry trends, and evolving threats, proactively adapting compliance and risk practices to strengthen the security posture.
• Coordinate closely through Information Security, Technology, Enterprise Risk, Internal Audit, Legal, Privacy, Procurement, business functions, and third parties to resolve dependencies, drive decisions, and ensure deliverables are completed on time and meet quality expectations.

This is not intended to be an all-inclusive list of job duties.