GRC Lead: Compliance, Risk & Vendor Oversight

Jobtailor; Houston (TX); On-site; USD 120,000 - 180,000; Full time

Job summary

Jobtailor is seeking a senior GRC leader to mature our governance, risk, and compliance program. The role focuses on translating regulatory requirements into controls, policies, and evidence collection while coordinating audits and certifications.

You will build a robust third-party risk program and own policy lifecycle, with an emphasis on data protection, privacy, and incident governance. Collaboration with Legal, IT, and stakeholders is essential.

Qualifications

• Bachelor’s degree or equivalent experience in a relevant field.
• Experience leading or implementing GRC programs and audits.
• Familiarity with major compliance standards (CMMC, GDPR, NIST CSF).
• Proven ability to translate requirements into controls, policies, and evidence collection.

Responsibilities

• Lead and mature the organization’s GRC program, including CMMC, GDPR, and other applicable requirements.
• Translate requirements into controls, policies, procedures, compliance roadmaps, and evidence-collection processes.
• Coordinate audits, assessments, certifications, customer questionnaires, remediation plans, and compliance reporting.
• Build and manage a third-party vendor-risk program with due diligence, risk assessments, and remediation tracking.
• Own lifecycle of policies, including review, publication, training, and exception management.
• Develop executive dashboards and reports on compliance posture, audits, and vendor risk.

Skills

Governance

Risk Management

Compliance

Audit Management

Policy Development

Control Implementation

Data Protection

Vendor Risk Management

Privacy Impact Assessment

Incident Response

Education

Bachelor’s degree in cybersecurity, information systems, business, risk management, law, or related field

Tools

GRC Tools

Audit Management Tools

Vendor Risk Management Tools

Workflow Tools

Job description

Jobtailor is seeking a senior GRC leader to mature our governance, risk, and compliance program. The role focuses on translating regulatory requirements into controls, policies, and evidence collection while coordinating audits and certifications.

You will build a robust third-party risk program and own policy lifecycle, with an emphasis on data protection, privacy, and incident governance. Collaboration with Legal, IT, and stakeholders is essential.