Director, Information Security GRC & Risk Leadership

PenFed Credit Union; McLean (VA); Hybrid; USD 122,000 - 284,000; Full time

Job summary

PenFed Credit Union seeks a Director, Information Security Governance, Risk, and Compliance (GRC) in a hybridTysons, VA setting. You will translate strategy into risk-based priorities, guide teams, and drive DRL responses, risk assessments, and remediation across the enterprise.

You will lead GRC efforts, coordinate with Legal, Internal Audit, and IT, and manage risk reporting to senior leadership with strong collaboration and influence.

Qualifications

• Master’s Degree and/or bachelor’s degree in computer science or related field preferred.
• Minimum of ten (10) years of relevant Information Security risk management experience.
• Proven experience leading, coaching, and developing teams in a complex security, risk, or compliance environment.
• Experience with security controls in large financial services organizations.
• Familiarity with NIST 800-53, NIST CSF, ISO 27001/2; knowledge of governance frameworks.

Responsibilities

• Lead and execute the Information Security risk management program across the organization.
• Perform risk assessments, RCSAs, and document risk conclusions clearly.
• Maintain and mature security risk frameworks, policies, and standards.
• Oversee third‑party information security risk management activities.
• Develop and report risk & compliance metrics and dashboards to leadership.
• Serve as primary contact for NCUA examinations and audits; manage DRLs and remediation.

Skills

Leadership

Strategic communication

Stakeholder management

Information security risk management

Education

Master’s degree in Computer Science or related field

CISSP, CISA, CISM, CRISC certifications

Tools

Archer

ServiceNow GRC

Job description

PenFed Credit Union seeks a Director, Information Security Governance, Risk, and Compliance (GRC) in a hybridTysons, VA setting. You will translate strategy into risk-based priorities, guide teams, and drive DRL responses, risk assessments, and remediation across the enterprise.

You will lead GRC efforts, coordinate with Legal, Internal Audit, and IT, and manage risk reporting to senior leadership with strong collaboration and influence.