Governance, Risk & Compliance Manager

VIAVI Solutions Inc.; Chandler (AZ); On-site; USD 140,000 - 180,000; Full time

Job summary

VIAVI Solutions is seeking a Manager, Governance, Risk & Compliance to lead and mature the company’s information security governance, cybersecurity risk, compliance and assurance capabilities.

This player-coach role involves direct risk assessments, policy development, control validation and audit readiness across ISMS, AI governance and CMMC, collaborating with Legal, IT, Privacy and Business teams to translate requirements into measurable outcomes.

Qualifications

• 10+ years of progressive cybersecurity and information security governance experience.
• Hands-on with governance, risk management, compliance, audit or security assurance.
• Experience leading major cybersecurity compliance and assurance programs.
• Strong ability to translate regulatory requirements into practical controls.

Responsibilities

• Lead and mature VIAVI's information security governance, risk, compliance and assurance capabilities.
• Provide hands-on risk assessments, policy development, control assessments, and audit preparation.
• Coordinate ISO 27001 and CMMC activities and AI governance initiatives.
• Partner with Legal, Privacy, IT, Security and business teams to align requirements.

Skills

Cybersecurity governance

Risk assessments

Policy development

Audit readiness

ISO 27001

CMMC

AI governance

Vendor risk management

Regulatory compliance

Security frameworks

Education

Bachelor's degree in a relevant field

Tools

GRC tools (e.g., Vanta, Drata)

Job description

Summary: VIAVI (NASDAQ: VIAV) is a global provider of network test, monitoring and assurance solutions for telecommunications, cloud, enterprises, first responders, military, aerospace, and railway. VIAVI is also a leader in light management technologies for 3D sensing, anti-counterfeiting, consumer electronics, industrial, automotive, government and aerospace applications. We are the people behind the products that help keep the world connected at home, school, work, at play, and everywhere in between. VIAVI employees are passionate about supporting customer success and we welcome people who bring their best every day to the company – to question, to collaborate and to push for solutions that will delight our customers.

Duties & Responsibilities:

Position Summary VIAVI Solutions is seeking a Manager, Governance, Risk & Compliance (GRC) to lead and mature the company's information security governance, cybersecurity risk, compliance and assurance capabilities. This is a player-coach role with a strong hands-on expectation. The successful candidate will provide leadership for the GRC function while remaining directly involved in risk assessments, policy development, control assessments, audit preparation, compliance activities, evidence reviews and remediation. The Manager will have key responsibility for VIAVI's ISO 27001, CMMC and AI Governance programs and will partner across Security Engineering, Cyber Defense, Product Security, IT, Legal, Privacy, Internal Audit and business teams. The role will help establish a scalable, risk-based governance model that translates regulatory, contractual and business requirements into clear security expectations, accountable ownership and measurable outcomes.

Key Responsibilities

Information Security Governance

• Develop, maintain and continuously improve the enterprise information security governance framework.
• Develop and maintain security policies, standards, procedures and supporting governance documentation.
• Establish clear security-control ownership and accountability across the organization.
• Maintain security exception, risk-acceptance and waiver processes.
• Translate regulatory, contractual and business requirements into practical security requirements.
• Promote consistent and sustainable security practices across the organization.

Cybersecurity Risk Management

• Develop and operate cybersecurity risk-management processes and methodologies.
• Lead risk assessments for significant technologies, business initiatives, third parties and changes to the technology environment.
• Maintain visibility into significant cybersecurity risks, owners, treatment plans, exceptions and residual risks.
• Facilitate risk-treatment and risk-acceptance decisions with business and technology stakeholders.
• Develop meaningful cybersecurity risk reporting for security leadership and executive stakeholders.

ISO 27001 & CMMC

• Lead the ongoing management and continuous improvement of VIAVI's Information Security Management System (ISMS).
• Coordinate ISO 27001 risk assessments, control reviews, internal assessments, corrective actions and certification/surveillance readiness.
• Lead GRC activities supporting CMMC readiness and ongoing compliance.
• Coordinate CMMC scoping, control ownership, documentation, evidence and assessment preparation.
• Partner with technical and business control owners to identify and remediate security-control gaps.
• Establish sustainable evidence-management and control-validation practices.

AI Governance

• Develop and mature VIAVI's enterprise AI governance and risk-management framework.
• Establish governance requirements for the responsible and secure adoption of AI technologies.
• Develop an AI risk-tiering approach considering factors such as data sensitivity, autonomy, technology risk and business impact.
• Establish governance processes for assessing and approving AI tools, applications and use cases.
• Define AI-related exception and risk-acceptance processes.
• Establish appropriate governance expectations for sensitive-data use and human oversight of higher-risk AI applications.
• Partner with Security Engineering to translate AI governance requirements into technical controls and guardrails.
• Partner with Legal, Privacy, Procurement, IT and business stakeholders on AI-related risk and governance requirements.
• Monitor relevant AI standards and regulatory developments and incorporate applicable requirements into VIAVI's governance program.
• Support alignment, as appropriate, with frameworks such as NIST AI RMF and ISO/IEC 42001.

Compliance, Assurance & Leadership

• Coordinate cybersecurity-related internal and external assessments and audits.
• Evaluate control implementation and supporting evidence against defined requirements.
• Coordinate remediation with control owners and monitor significant security and compliance gaps.
• Partner with Legal, Privacy, Internal Audit, Security and technology teams on overlapping regulatory and assurance requirements.
• Support customer or third-party cybersecurity assurance activities as appropriate.
• Operate as a player-coach, personally performing critical GRC work while developing the broader capability.
• Mentor team members and establish repeatable, sustainable GRC processes rather than point-in-time compliance activities.

Pre-Requisites / Skills / Experience Requirements:

Required Qualifications

• 10+ years of progressive experience in cybersecurity, information security governance, risk management, compliance, audit or security assurance.
• Significant hands-on experience with cybersecurity governance and risk-management activities.
• Demonstrated experience leading or materially contributing to major cybersecurity compliance, audit or assurance programs.
• Experience developing policies, performing risk assessments, evaluating controls, reviewing evidence and managing remediation.
• Strong understanding of common cybersecurity frameworks and control concepts.
• Experience translating regulatory, contractual and risk requirements into practical control requirements.
• Experience working collaboratively across technical, Legal, Privacy, Audit and business stakeholders.
• Strong written and verbal communication skills, including the ability to communicate cybersecurity risk to leadership.
• Demonstrated leadership, stakeholder-management and mentoring capabilities.
• Experience with AI governance, AI risk management or emerging technology governance.
• Experience with implementing and maintaining tools like Vanta, Drata, Sprinto etc.
• Familiarity with Third-Party Vendor Risk Management processes
• Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
• Familiarity with managing Security Awareness Program including tools like KnowBe4, Adaptive Security etc.
• Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor or comparable credentials.
• Previous people-management or GRC team-leadership experience.
• This position requires use of information which is subject to the International Traffic in Arms Regulations (ITAR). All applicants must be U.S. Persons within the meaning of ITAR. ITAR defines a U.S. Person as a U.S. Citizen or National, U.S. Lawful Permanent Resident (i.e. 'Green Card Holder'), Political Asylee, Refugee, or Temporary Resident granted amnesty.

Preferred Qualifications

• Experience leading or operating an ISO 27001 ISMS.
• Experience with CMMC and/or NIST SP 800-171.
• Experience with cybersecurity regulatory or customer assurance requirements.
• Experience with AI governance, AI risk management or emerging technology governance.
• Experience with implementing and maintaining tools like Vanta, Drata, Sprinto etc.
• Familiarity with Third-Party Vendor Risk Management processes
• Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
• Familiarity with NIST AI RMF, ISO/IEC 42001 or similar AI governance frameworks.
• Familiarity with managing Security Awareness Program including tools like KnowBe4, Adaptive Security etc.

VIAVI Solutions is an equal opportunity and affirmative action employer – minorities/females/veterans/persons with disabilities.

VIAVI empowers Service Providers and IT organizations to manage the network lifecycle for complex 5G and Fiber networks with intuitive instruments, systems and technologies; and our expertise in light management and optical coatings help protect the world's bank notes from counterfeiters, enhance the colors you see, and enable advanced technology such as 3D sensing.

We are a team of thought leaders who have the freedom to support and innovate and look for new effective and efficient solutions for our customers.