GRC Architect & Risk Strategy Leader

Palo Alto Networks, Inc.

Santa Clara (CA)

On-site

USD 168,000 - 271,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Palo Alto Networks seeks a Principal InfoSec GRC Business Engineer to architect and mature our Global Governance, Risk, and Compliance programs. You will bridge security engineering, enterprise risk management, and business operations by designing global governance frameworks and scalable risk assessment methodologies.

Leverage AI, automation, and continuous control monitoring to embed security into product, platform, and enterprise operations.

Qualifications

10+ years of experience in Information Security or IT Risk with 6+ years in GRC and enterprise risk in global environments.
Bachelor’s or Master’s degree in Computer Science, Cybersecurity, MIS, or equivalent.
Active certification in CISSP, CRISC, CISM, or CISA.
Deep knowledge of ISO 27001/2, NIST SP 800-53, NIST CSF, SOC 2 Type II, PCI-DSS, GDPR, and enterprise risk frameworks.
Proven track record of risk management processes and executive reporting.
Hands-on experience with GRC platforms and automation teams.
Experience configuring GRC tools at application level for workflows and in-app automations.
Experience across multi-cloud (AWS, Azure, GCP) and modern enterprise architecture.
Excellent communication and cross-functional collaboration skills.

Responsibilities

Design and scale the global GRC vision to align security governance with enterprise goals and regulatory mandates.
Partner with senior leaders across Information Security, Legal, and Product Engineering to align risk tolerance with business objectives.
Lead drafting, maintenance, rollout, and annual review of information security policies, standards, procedures, and guidelines.
Translate complex regulatory and security frameworks into actionable security requirements.
Architect and refine risk assessment methodologies for cloud, SaaS, and hybrid environments.
Lead end-to-end security risk evaluations for applications, infrastructure, and processes.
Design and manage executive-level risk reporting to provide visibility into risk posture and drive risk reduction.
Lead implementation and continuous improvement of enterprise GRC platforms and tools.
Design and implement test plans and policy-as-code for automated evidence collection and real-time testing.
Redesign manual risk and compliance processes into scalable automated workflows.