GRC Lead - Information Security & ISO 27001 (Remote)

O'Melveny & Myers LLP; Los Angeles (CA); Remote; USD 125,000 - 165,000; Full time

Benefits offered by this job

Excellent benefits

Job summary

O’Melveny & Myers LLP seeks an experienced Information Security Governance, Risk and Compliance Lead. The role can be remote or based in any U.S. office, including Los Angeles, with responsibilities spanning firmwide GRC initiatives, risk analyses, and policy enforcement.

The ideal candidate brings deep ISO/IEC 27001 knowledge, strong leadership, and expertise in coordinating audits and third‑party risk. A proactive, cross‑functional approach is essential to strengthen the firm’s information

Qualifications

• Five years of experience in GRC or as a cybersecurity practitioner.
• Experience in distributed or hybrid office environments.
• Knowledge of ISO/IEC 27001, NIST, HIPAA, HITRUST, GDPR; GLBA optional.
• Bachelor’s degree in a related field is required.
• Experience coordinating disaster recovery and tabletop exercises is a plus.
• Excellent analytical and problem-solving abilities; strong written and verbal communication.

Responsibilities

• Lead firmwide Information Security GRC initiatives with the Information Security team.
• Coordinate ISO 27001 recertifications and client audits.
• Develop and enforce a comprehensive GRC program across the firm.
• Oversee third-party and vendor risk management.
• Produce timely GRC reports for management and audits.
• Work with legal, IT, finance and operations to ensure controls and policies are aligned.

Skills

GRC experience

ISO 27001 knowledge

NIST / HIPAA / GDPR knowledge

Security auditing coordination

Leadership

Tabletop exercises

Strong communication

CISSP/CISM/CISA/CRISC

Hybrid/Distributed teamwork

Education

Bachelor's degree in Cybersecurity/CS/Data Science

Job description

O’Melveny & Myers LLP seeks an experienced Information Security Governance, Risk and Compliance Lead. The role can be remote or based in any U.S. office, including Los Angeles, with responsibilities spanning firmwide GRC initiatives, risk analyses, and policy enforcement.

The ideal candidate brings deep ISO/IEC 27001 knowledge, strong leadership, and expertise in coordinating audits and third‑party risk. A proactive, cross‑functional approach is essential to strengthen the firm’s information