Information Security Governance, Risk and Compliance (GRC) Lead

O'Melveny & Myers LLP; Austin (TX); Teletrabalho; USD 140 000 - 190 000; Tempo integral

Resumo da oferta

O’Melveny & Myers LLP is seeking an Information Security Governance, Risk and Compliance Lead to drive a firmwide GRC program. The role can be remote or based in a U.S. office, with a focus on coordinating risk, policy, and controls across the organization.

The GRC Lead will work with Information Security and business teams to implement risk-based controls, track regulatory changes, and prepare for audits and third-party assessments. Strong leadership and communication skills are essential.

Qualificações

• Five years of experience in GRC or as a cybersecurity practitioner.
• Experience in distributed and hybrid office environments.
• Understanding of ISO/IEC 27001, NIST, HIPAA, HITRUST, GDPR, GLBA (optional).
• Bachelor's degree in Cybersecurity, Computer Science, Data Science, or related field.
• Professional certifications are a plus (CISSP, CISM, CISA, CRISC or CGRC).

Responsabilidades

• Lead firmwide Information Security GRC initiatives with Information Security team.
• Coordinate ISO 27001 certifications and client audits.
• Track regulatory requirements and maintain audit responses.
• Oversee third-party and vendor risk management within GRC.
• Develop and enforce policies, standards, and control frameworks.
• Provide management with timely GRC reports and metrics.

Conhecimentos

GRC

Cybersecurity

Risk management

Compliance

Regulatory knowledge

Formação académica

Bachelor's degree in Cybersecurity/CS/related field

Descrição da oferta de emprego

It’s more than what you do: it’s how you do it. That’s why O’Melveny is counsel of choice to an ever-expanding list of market leaders. Opportunity at O’Melveny means working alongside dynamic and team-oriented colleagues on evolving legal and business issues and opportunities for prominent clients around the world. It’s a place to build a rewarding career by tackling new challenges; being appreciated, included, and supported; and creating lasting connections.

With approximately 850 lawyers on three continents, more than 80 practice and industry service areas, and strong cultural ties to its 17 locations, O’Melveny is a global law firm with a local feel. At our core, you’ll find a dedication to excellence, a drive to lead and innovate, and a deep sense of civic responsibility.

So, tell us. What do you want to achieve? Visit us at www.omm.com; learn more in our firm at-a-glance; and find us on LinkedIn, Facebook, Instagram, and YouTube.

O’Melveny has an immediate opening for an Information Security Governance, Risk and Compliance (GRC) Lead. This position can be remote or based out of any of our U.S. offices (Austin, Century City, Dallas, Houston, Los Angeles, New York City, Newport Beach, San Francisco, Silicon Valley, Washington DC). This application is for the Austin office.

The Information Security Governance, Risk and Compliance (GRC) Lead serves as the subject matter expert for firmwide Information Security GRC initiatives, collaborating closely with the Information Security Officer. This role encompasses the development, implementation and ongoing coordination of GRC efforts. The GRC Lead is responsible for tracking information security risks, conducting risk analyses and mitigation options, coordinating information security metrics, while regularly tracking and reporting to Information Security leadership. In addition, the Lead accepts duties to enforce GRC rigor globally for firmwide information security obligations. Additionally, this role involves implementing and advancing policies and a comprehensive control framework to execute the GRC strategy. The GRC Lead oversees the administration of standards and controls, risk management, third-party risk (TPRM), baseline security controls and technology compliance initiatives. The GRC Lead coordinates information security audits and assessments, including tracking, timely responses, and interactions with O’Melveny clients and external auditors. The GRC Lead will also assist with reviewing outside counsel guidelines. This position will also develop a third-party risk management program, and assist with reviewing third-party risk, utilizing tools as well as reviewing due diligence documentation, such as questionnaires and SOC reports.

This position requires a deep understanding of ISO/IEC 27001, risk management methodologies, technical controls, and a proactive approach to addressing both operational and strategic risks. The GRC Lead collaborates with a cross‑functional team of information security and information technology analysts to evaluate controls, map them to key performance indicators, measure effectiveness and produce timely reports for management. These reports are essential for identifying, evaluating and reporting on cybersecurity risks that may impact the business, ensuring informed decision‑making. Strong business acumen and a diverse technical background are crucial for understanding emerging technologies and legacy systems considered business critical. The GRC Lead reports to the Information Security Officer.

Remote applications will be accepted from candidates who reside in the following states: AL, AZ, CA, CO, D.C., FL, HI, ID, IL, LA, MD, MA, MN, MO, NC, NH, NV, NJ, NY, OH, OR, PA, SC, TX, UT, VA, WA, WV.

Essential Duties And Responsibilities

• Lead firmwide Information Security GRC initiatives in partnership with the Information Security team.
• Assist and coordinate with the firm’s ISO 27001 annual re-certifications, as well as with client audits.
• Be familiar with external requirements, such as outside counsel guidelines, and assist with tracking, review, and response.Respond to these reviews in a timely manner.
• Oversee Information Security GRC activities and coordinate closely with the Information Security Officer.
• Serve as a subject matter expert and trusted advisor for leadership on Information Security GRC matters.
• Serve as the primary contact for responding to business unit inquiries regarding operational compliance.
• Collaborate with IT, legal, finance and operations to develop a cohesive Information Security GRC program.
• Partner with business units during solutions onboarding to ensure adequate controls are in place and enabled.
• Conduct regular risk assessments, analyzing emerging risks across the organization.
• Coordinate with stakeholders to implement effective risk mitigation strategies.
• Maintain a strategic and comprehensive GRC program that includes policies, standards, processes and guidelines.
• Stay updated on regulatory changes and industry standards, such as ISO, NIST, GDPR, HITRUST and HIPAA.
• Provide guidance to team members to ensure compliance with relevant laws and regulations.
• Deliver GRC reports to management, emphasizing compliance status, risk exposure and mitigation efforts.
• Oversee third-party and vendor risk as an integral part of the organization’s risk management strategy.
• Document, communicate and enforce cybersecurity standards that balance risk with business operations.
• Document GRC activities, policies, assessments and corrective actions to ensure audit readiness.
• Implement process improvements using GRC tools and methodologies to drive productivity gains.
• Cooperate with internal and external auditors to maintain and implement controls that meet GRC requirements.
• Motivate functional areas to implement practices that comply with cybersecurity policies and standards.
• Provide leadership in collaboration with technical and business teams to strengthen business resiliency.
• Guide team to align with security, audit and risk management efforts in ongoing security program assessments.

Knowledge, Skills, And Experience Preferred

• Five years of experience in GRC or as a cybersecurity practitioner, including roles in security analysis, compliance, and risk management.
• Experience working in a distributed and hybrid office team.
• Understanding of information security and privacy frameworks:ISO/IEC 27001 is required, NIST, HIPAA, HITRUST, GDPR, and GLBA are optional.
• Bachelors degree in Cybersecurity, Computer Science, Data Science, or a related field.
• Experience conducting tabletop exercises, coordinating disaster recovery exercises, and other information security control tests is ideal.
• Excellent analytical and problem-solving abilities.
• Effective communication and interpersonal skills and ability to work independently and collaboratively in a multidisciplinary team environment.Excellent written and verbal communication skills.
• Candidate should be able to effectively interact with all levels of staff.
• Professional certifications are a plus (CISSP, CISM, CISA, CRISC or CGRC).
• Candidates must be internally motivated and self-driven for excellent results.
• Must have strong leadership skills, providing project leadership as needed, and excellent written and verbal communication skills.
• The ability to work in a team or work independently on complex tasks with minimal technical and management guidance is required.
• Must meet deadlines and deliver status updates to project team frequently.

We offer an excellent salary and benefits package. For more information, or to be considered for this position, please apply online at www.omm.com. Response will be given to candidates who closely meet our qualifications. EOE M/F/D/V. No phone inquiries please.