Head of GRC & Information Security

Taft Stettinius & Hollister LLP; Atlanta (GA); On-site; USD 140,000 - 200,000; Full time

Job summary

Taft Stettinius & Hollister LLP seeks a Director, Governance, Risk & Compliance to mature the firm’s information security governance, risk, compliance, and assurance programs. You will coordinate across Information Security, IT, Privacy, Legal, and Procurement while advising on material compliance gaps and risk trends.

The role covers ISO/IEC 27001 ISMS, ISO/IEC 27701 privacy controls, ISO/IEC 42001 AI governance, and CMMC/CUI compliance, with ongoing readiness for certification.

Qualifications

• Bachelor’s degree and 10+ years in information security, governance, risk, and compliance roles.
• 5+ years of leadership in GRC, security audits, or risk management.
• Experience operating an ISO/IEC 27001-certified ISMS.
• Experience managing audits, assessments, and evidence.
• Ability to collaborate across technical, legal, privacy, procurement, and business teams.

Responsibilities

• Develop, operate, and mature the firm’s GRC programs, including governance, risk, compliance, and assurance.
• Establish integrated control frameworks aligning standards, regulations, contracts, and client requirements.
• Coordinate GRC priorities and roadmaps with the CISO and leadership.
• Lead ISO/IEC 27001 ISMS operations, certification activities, and improvement.
• Lead privacy, AI governance, and vendor risk programs and related certifications.
• Provide GRC leadership for CMMC and CUI compliance and audits.

Skills

Cross-functional collaboration

Governance & risk management

Policy writing

Project & program management

Information security concepts

Education

Bachelor’s degree in information security or related field

Master’s degree in Cybersecurity/Information Systems (preferred)

Job description

Taft Stettinius & Hollister LLP seeks a Director, Governance, Risk & Compliance to mature the firm’s information security governance, risk, compliance, and assurance programs. You will coordinate across Information Security, IT, Privacy, Legal, and Procurement while advising on material compliance gaps and risk trends.

The role covers ISO/IEC 27001 ISMS, ISO/IEC 27701 privacy controls, ISO/IEC 42001 AI governance, and CMMC/CUI compliance, with ongoing readiness for certification.