GRC Manager - Technology Risk & Governance

pinnaclegroup; EE. UU.; A distancia; USD 110.000 - 190.000; Jornada completa

Descripción de la vacante

PinnacleGroup is seeking a Vendor Risk and Compliance Leader to steer technology governance and third‑party risk across cybersecurity, privacy, AI, and regulatory programs. You’ll partner with security, legal, IT, and business teams to strengthen audit readiness and certifications.

The role focuses on overseeing vendor risk reviews, evaluating evidence from audits and tests, coordinating with vendors and auditors, and delivering governance dashboards to leadership.

Formación

• Bachelor’s degree in information systems, cybersecurity, risk management, compliance, or related field.
• Experience in technology risk, governance, compliance, information security, audit, or third-party risk management.
• Experience assessing technology vendors, including cloud services, software providers, managed service providers, or AI-enabled products.
• Knowledge of ISO 27001, SOC, NIST, or CIS Controls.
• Experience working with auditors and responding to risk-related questionnaires.
• Strong written and verbal communication to explain risk findings to technical and non-technical audiences.

Responsabilidades

• Lead vendor risk reviews from onboarding through reassessments, tailoring evaluation to risk level.
• Review security and compliance evidence such as audit reports, certifications, penetration test results, continuity plans, and privacy materials.
• Coordinate with vendors, auditors, and internal teams to gather evidence and respond to assessment requests and questionnaires.
• Document risks, findings, mitigations, and supporting evidence in line with internal procedures.
• Prepare risk summaries, dashboards, and governance materials for leadership and committee discussions.
• Help maintain security certifications and compliance programs, develop AI risk practices, and improve business continuity planning.

Conocimientos

Technology risk management

Governance

Compliance

Information security

Audit

Vendor risk management

Educación

Bachelor’s degree in information systems or related field

Herramientas

Drata

Descripción del empleo

Role overview

Lead technology governance and third-party risk activities, helping the organization assess vendors and manage cybersecurity, privacy, AI, and compliance risks. The role works across security, legal, compliance, IT, and business teams, while supporting audit readiness and ongoing security certifications.

Responsibilities

• Manage vendor risk reviews from onboarding through periodic reassessments, tailoring evaluation to the level and type of risk.
• Review security and compliance evidence such as audit reports, certifications, penetration test results, continuity plans, and privacy materials.
• Coordinate with vendors, auditors, and internal teams to gather evidence and respond to assessment requests and questionnaires.
• Document risks, findings, mitigations, and supporting evidence in line with internal procedures.
• Prepare risk summaries, dashboards, and governance materials for leadership and committee discussions.
• Help maintain security certifications and compliance programs, develop AI risk practices, and improve business continuity planning.

Requirements

• Bachelor’s degree in information systems, cybersecurity, risk management, compliance, or a related field.
• Experience in technology risk, governance, compliance, information security, audit, or third-party risk management.
• Experience assessing technology vendors, including cloud services, software providers, managed service providers, or AI‑enabled products.
• Working knowledge of security and compliance frameworks such as ISO 27001, SOC standards, NIST, or CIS Controls.
• Experience working with auditors and responding to security, risk, compliance, or vendor questionnaires.
• Clear written and verbal communication skills, including the ability to explain risk findings to technical and non‑technical audiences.

Nice to have

• Experience with a governance, risk, and compliance platform such as Drata.
• Knowledge of AI‑related risks, controls, governance practices, and emerging compliance considerations.