Director of Cybersecurity GRC

Kforce Inc; West Valley City (UT); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical/Dental/Vision insurance

HSAs and FSAs

401(k) retirement plan

Paid time off

Job summary

Kforce is seeking a Director of Cybersecurity GRC in Salt Lake City, UT to lead enterprise risk management, governance, and regulatory compliance. You will oversee risk assessments, policy development, and vendor security reviews while collaborating with technology, legal, privacy, audit, and executive teams.

The role requires deep knowledge of NIST, ISO 27001, PCI-DSS, and related standards, plus experience driving policy adoption, awareness programs, and security training across the

Qualifications

• 5+ years of experience in cybersecurity governance, risk management, compliance, or information security leadership.
• Experience conducting enterprise risk assessments and developing risk mitigation strategies.
• Experience managing security awareness and training programs.
• Experience supporting compliance efforts related to PCI-DSS, GDPR, CCPA, SOX, or similar frameworks.
• Proven success in creating and maintaining cybersecurity policies, standards, and governance frameworks.
• Strong understanding of audit processes and regulatory compliance requirements.

Responsibilities

• Lead enterprise cybersecurity governance and risk management initiatives.
• Conduct ongoing risk assessments to identify threats, vulnerabilities, and emerging cybersecurity concerns.
• Develop, maintain, and execute risk treatment and mitigation plans aligned with business objectives.
• Monitor organizational risk exposure and communicate risk findings to leadership and stakeholders.
• Ensure alignment with industry standards, regulatory requirements, and internal controls.
• Develop and maintain cybersecurity policies, standards, procedures, and governance frameworks.
• Evaluate and update security documentation to align with evolving threats, business needs, and regulatory expectations.
• Partner with business units to drive policy adoption, awareness, and compliance throughout the organization.
• Design and manage enterprise-wide cybersecurity awareness programs.

Skills

Vendor risk programs

Cybersecurity frameworks

Privacy regulations

Risk identification

AI governance

Analytical skills

Communication skills

Stakeholder management

Job description

Responsibilities

Kforce has a client that is seeking a Director of Cybersecurity GRC in Salt Lake City, UT. Overview: We are seeking an experienced Director of Cybersecurity GRC to lead enterprise cybersecurity risk management, compliance initiatives, and governance programs. This individual will play a key role in strengthening the organization's security posture by overseeing risk assessments, policy development, regulatory compliance efforts, vendor security reviews, security awareness programs, and cybersecurity reporting. The ideal candidate will have a strong background in cybersecurity governance frameworks, risk management methodologies, regulatory compliance, and cross‑functional collaboration. This role works closely with technology, audit, legal, privacy, procurement, and executive leadership teams to ensure cybersecurity risks are effectively identified, managed, and communicated across the organization. Key Responsibilities: Governance, Risk Management & Compliance:

• Lead enterprise cybersecurity governance and risk management initiatives
• Conduct ongoing risk assessments to identify threats, vulnerabilities, and emerging cybersecurity concerns
• Develop, maintain, and execute risk treatment and mitigation plans aligned with business objectives
• Monitor organizational risk exposure and communicate risk findings to leadership and stakeholders
• Ensure alignment with industry standards, regulatory requirements, and internal controls

Security Policies & Standards

• Develop and maintain cybersecurity policies, standards, procedures, and governance frameworks
• Evaluate and update security documentation to align with evolving threats, business needs, and regulatory expectations
• Partner with business units to drive policy adoption, awareness, and compliance throughout the organization

Security Awareness & Training

• Design and manage enterprise-wide cybersecurity awareness programs

Requirements

• 5+ years of experience in cybersecurity governance, risk management, compliance, or information security leadership
• Experience conducting enterprise risk assessments and developing risk mitigation strategies
• Experience managing security awareness and training programs
• Experience supporting compliance efforts related to PCI‑DSS, GDPR, CCPA, SOX, or similar frameworks
• Proven success in creating and maintaining cybersecurity policies, standards, and governance frameworks
• Strong understanding of audit processes and regulatory compliance requirements

Preferred Certifications

• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CRISC (Certified in Risk and Information Systems Control)
• CDPSE (Certified Data Privacy Solutions Engineer)

Desired Skills & Competencies

• Experience managing third‑party and vendor cybersecurity risk programs
• Strong knowledge of cybersecurity control frameworks including NIST CSF, NIST 800-series, ISO 27001, and PCI‑DSS
• Knowledge of privacy regulations and data protection standards
• Expertise in cybersecurity risk identification, assessment, reporting, and remediation planning
• Familiarity with AI governance, emerging technology risks, and security implications of AI adoption
• Strong analytical, organizational, and problem‑solving capabilities
• Excellent verbal and written communication skills with the ability to engage both technical and non‑technical stakeholders
• Ability to build relationships and influence cross‑functional teams across technology, legal, privacy, audit, and business functions

The pay range is the lowest to highest compensation we reasonably in good faith believe we would pay at posting for this role. We may ultimately pay more or less than this range. Employee pay is based on factors like relevant education, qualifications, certifications, experience, skills, seniority, location, performance, union contract and business needs. This range may be modified in the future.

We offer comprehensive benefits including medical/dental/vision insurance, HSA, FSA, 401(k), and life, disability & ADD insurance to eligible employees. Salaried personnel receive paid time off. Hourly employees are not eligible for paid time off unless required by law. Hourly employees on a Service Contract Act project are eligible for paid sick leave.

Note: Pay is not considered compensation until it is earned, vested and determinable. The amount and availability of any compensation remains in Kforce's sole discretion unless and until paid and may be modified in its discretion consistent with the law.

This job is not eligible for bonuses, incentives or commissions.

Kforce is an Equal Opportunity/Affirmative Action Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, pregnancy, sexual orientation, gender identity, national origin, age, protected veteran status, or disability status.