GRC Lead: Enterprise Cyber Risk Governance

Pueo Business Solutions LLC; Virginia, Northern (MN, KY); Hybrid; USD 140,000 - 190,000; Full time

Job summary

Pueo is seeking a GRC Lead – CIO Enterprise Risk Management Working Group to provide strategic oversight for implementing the agency's cybersecurity risk management framework. You will chair CERMS WG, coordinate with CIO leadership, and develop governance artifacts to support enterprise risk decisions.

The role requires extensive program management, risk expertise, and the ability to communicate complex concepts to executives across directorates.

Qualifications

• Twelve (12) years of relevant experience in program management, risk management, cybersecurity governance, or related disciplines.
• Minimum five (5) years of experience managing enterprise-level governance programs or cybersecurity risk management initiatives.
• Demonstrated experience coordinating cross-directorate or cross-functional stakeholders in complex organizational environments.
• Experience developing and implementing policy or governance frameworks within Government, DoD, Intelligence Community, or similarly regulated environments.
• Expert knowledge of cybersecurity and enterprise risk management frameworks.
• Demonstrated experience facilitating senior or executive-level working groups.
• Strong written and verbal communication skills with experience communicating to executive audiences.

Responsibilities

• Lead implementation and maturation of the CERMS WG Charter and associated enterprise cybersecurity risk governance framework.
• Provide strategic program management and oversight for enterprise cybersecurity risk management initiatives.
• Coordinate with CIO-5 Strategy & Programs Office on strategic risk management priorities and activities.
• Develop and maintain comprehensive project plans, milestones, action items, and implementation schedules.
• Provide recurring program status, risk, and performance reporting to CIO-4 leadership.
• Coordinate stakeholder engagement across CIO organizations, SPP/DDI, Deputy Directors, J2s, Director-level leadership, and other Agency stakeholders.
• Lead development of CIO-4 Administrative Instructions, governance documentation, and supporting enterprise risk management policies.
• Develop CIO-4 SOPs governing cybersecurity risk tolerance decisions and supporting processes.
• Define and document escalation protocols, decision authorities, and organizational responsibilities for enterprise and system-level risk decisions.
• Coordinate policy review, adjudication, concurrence, and approval processes across Agency stakeholders.
• Guide CERMS WG meetings and facilitate executive and cross-directorate stakeholder discussions.

Skills

Program Management

Enterprise Risk Management

Cybersecurity Governance

Executive Working Group Facilitation

Policy Development

Risk Tolerance & Decision Frameworks

Stakeholder Management

Cybersecurity Authorization

Executive Reporting

Strategic Communication

Artifact Management

Organizational Change Management

Education

Bachelor's degree in Business Administration, Information Systems, Cybersecurity, or a related field

Job description

Pueo is seeking a GRC Lead – CIO Enterprise Risk Management Working Group to provide strategic oversight for implementing the agency's cybersecurity risk management framework. You will chair CERMS WG, coordinate with CIO leadership, and develop governance artifacts to support enterprise risk decisions.

The role requires extensive program management, risk expertise, and the ability to communicate complex concepts to executives across directorates.