Governance, Risk and Compliance Program Manager

Tennessee Comptroller of the Treasury; Nashville (TN); On-site; USD 85,000 - 120,000; Full time

Job summary

Tennessee Comptroller of the Treasury is seeking an Information Governance, Policy, and Compliance Program Manager to develop and maintain governance, policy, risk, and compliance programs across the organization. You will coordinate with Technology Solutions, legal, internal audit, procurement, and business units to protect and manage organizational information.

The role sits within the security team, leading data governance, policy lifecycle, audits, and risk remediation while delivering

Qualifications

• Bachelor’s degree or equivalent experience in IT, cybersecurity, information systems, or related field.
• Experience developing or managing organizational policies, compliance programs, risk management, audits, information governance, or cybersecurity governance.
• Strong written and verbal communication for technical and nontechnical audiences.
• Proven ability to manage multiple initiatives, meet deadlines, and coordinate across teams.
• Sound judgment when handling sensitive or regulated information.

Responsibilities

• Manage the Office’s information security, privacy, technology, and data governance policies and lifecycle.
• Lead the data governance program: ownership, classification, stewardship, retention, access, and use.
• Coordinate compliance activities across laws, audits, standards; maintain risk register and corrective actions.
• Collect and organize audit evidence and support assessments and regulatory inquiries.
• Document risk assessments, mitigations, exceptions, and remediation plans; report status to leadership.
• Coordinate third‑party and vendor risk reviews with Procurement, GC, and Technology Solutions.
• Support business continuity, disaster recovery, and incident‑response documentation.
• Develop and deliver communications and training on security, privacy, data governance, and policy awareness.
• Provide clear reporting on compliance posture, data governance, risks, and decisions.

Skills

Information governance

Policy development

Risk management

Audits & compliance

Cross‑functional collaboration

Technical writing

Education

Bachelor’s degree in IT/cybersecurity/records management or related field

Tools

NIST CSF

ISO 27001

CIS Controls

Job description

Join us in our mission to make government work better.

Role Snapshot

The Information Governance, Policy, and Compliance Program Manager develops, maintains, and coordinates the Comptroller’s Office information governance, technology policy, risk, and compliance programs. The role establishes consistent practices for protecting, using, retaining, and managing organizational information and data while coordinating policies, compliance obligations, risk remediation, audit support, data governance, security awareness, and related documentation. The position is part of the security team and works across the Office with Technology Solutions leadership, business units, legal counsel, internal audit, procurement, and other stakeholders.

Why You'll Love This Job

• Meaningful work that strengthens public accountability and responsible information management
• A central role in shaping information governance, technology policy, risk, and compliance practices
• Opportunities to collaborate across Technology Solutions, legal, audit, procurement, business units, and executive leadership
• Work that improves governance processes, controls, documentation, and organizational accountability
• Opportunities to build sustainable data governance, policy management, compliance, and risk‑remediation programs

What You'll Do

• Manage and maintain the Office’s information security, privacy, technology, and data‑governance policies and oversee a formal policy lifecycle
• Lead the data governance program, including ownership, classification, stewardship, retention, access, and appropriate use
• Coordinate compliance activities across laws, regulations, standards, audits, and internal requirements; maintain the compliance calendar, control library, risk register, and corrective‑action tracking
• Collect and organize audit evidence and support assessments, reviews, and regulatory inquiries
• Conduct and document risk assessments, mitigating controls, exceptions, and remediation plans; track findings through resolution and report status to leadership
• Coordinate third‑party and vendor risk reviews with Procurement, General Counsel, and Technology Solutions
• Support business continuity, disaster recovery, incident‑response, and technology‑risk documentation
• Develop and deliver communications and training related to security, privacy, data governance, and policy awareness
• Provide clear reporting to Technology Solutions, security leadership, and executive management on compliance posture, data governance, risks, and required decisions
• Promote consistent governance practices across departments and identify opportunities to improve controls, processes, and documentation
• Perform related duties as needed in information governance, policy management, risk, and compliance

What We're Looking For

• Bachelor’s degree in IT, cybersecurity, information systems, business/public administration, records management, or related field (or equivalent experience)
• Experience developing or managing organizational policies, compliance programs, risk management, audits, information governance, data governance, or cybersecurity governance
• Strong written and verbal communication skills for both technical and nontechnical audiences
• Proven ability to manage multiple initiatives, meet deadlines, maintain detailed documentation, and coordinate across teams
• Sound judgment when handling sensitive or regulated information

Preferred

• Experience in government, public‑sector, financial, audit, or other regulated environments
• Knowledge of NIST, CIS Controls, COBIT, ISO 27001, or similar frameworks
• Familiarity with privacy, records management, data classification, retention, access governance, and vendor/third‑party risk
• Experience supporting audits, assessments, regulatory reviews, or corrective‑action programs
• Certifications such as CISA, CRISC, CGRC, CISSP, CIPM, CDMP, or similar

Other combinations of education and experience, if equivalent, may qualify an applicant for consideration.

Logistics

• Reporting Relationship: Part of the security team and reports to the Cybersecurity Manager
• Collaboration: Works across the Comptroller’s Office with regular interaction with executive leadership and operational departments

About The Office

The Office of the Tennessee Comptroller of the Treasury audits state and local government entities and oversees financial and administrative operations of state government. We are nationally recognized for professionalism and accountability and strive every day to make government work better. We are proud to be a Top Workplace and support an environment where employees are encouraged to grow, collaborate, and lead. Learn more at www.comptroller.tn.gov.

Equal Opportunity Employer

We are committed to fair and equal employment opportunities and maintaining a workplace free of discrimination and harassment. We prohibit discrimination based on race, color, national origin, age, sex, sexual orientation, gender identity, pregnancy, religion, disability, veteran status, or any category protected by law.

NOTICE

This position requires a criminal background check. You may be required to provide information about your criminal history to be considered for this position.