Information Security Governance, Risk and Compliance (GRC) Lead

O'Melveny & Myers LLP; Beverly Hills (CA); Remote; USD 125,000 - 165,000; Full time

Job summary

O’Melveny & Myers LLP is seeking an Information Security Governance, Risk and Compliance (GRC) Lead. This role can be remote or based in any U.S. office, with Century City as one option.

The GRC Lead drives firmwide GRC initiatives, tracks risks, and enforces cyber policy across business units. Requirements include ISO 27001 knowledge, extensive GRC experience, and strong cross-functional collaboration. The position offers a competitive salary and comprehensive benefits within a hybrid/remote

Qualifications

• Five years of experience in GRC or a cybersecurity practitioner, including roles in security analysis, compliance, and risk management.
• Experience working in a distributed and hybrid office team.
• ISO/IEC 27001 required; NIST, HIPAA, HITRUST, GDPR optional.
• Bachelor's degree in Cybersecurity, Computer Science, Data Science, or related field.
• Professional certifications are a plus (CISSP, CISM, CISA, CRISC or CGRC).

Responsibilities

• Lead firmwide Information Security GRC initiatives in partnership with the Information Security team.
• Assist and coordinate ISO 27001 re-certifications, as well as client audits.
• Oversee Information Security GRC activities and coordinate with the Information Security Officer.
• Develop a cohesive Information Security GRC program with IT, legal, finance and operations.
• Coordinate with stakeholders to implement risk mitigation strategies.
• Document, communicate and enforce cybersecurity standards.

Skills

GRC experience

Cybersecurity

Risk management

Security analysis

Regulatory awareness

Education

Bachelor's degree – cybersecurity/CS/DS

Job description

It’s more than what you do: it’s how you do it.

That’s why O’Melveny is counsel of choice to an ever-expanding list of market leaders. Opportunity at O’Melveny means working alongside dynamic and team-oriented colleagues on evolving legal and business issues and opportunities for prominent clients around the world. It’s a place to build a rewarding career by tackling new challenges; being appreciated, included, and supported; and creating lasting connections.

With approximately 850 lawyers on three continents, more than 80 practice and industry service areas, and strong cultural ties to its 17 locations, O’Melveny is a global law firm with a local feel. At our core, you’ll find a dedication to excellence, a drive to lead and innovate, and a deep sense of civic responsibility.

So, tell us. What do you want to achieve? Visit us at www.omm.com; learn more in our firm at-a-glance; and find us on LinkedIn, Facebook, Instagram, and YouTube.

O’Melveny has an immediate opening for an Information Security Governance, Risk and Compliance (GRC) Lead. This position can be remote or based out of any of our U.S. offices (Austin, Century City, Dallas, Houston, Los Angeles, New York City, Newport Beach, San Francisco, Silicon Valley, Washington DC). This application is for the Century City office.

The Information Security Governance, Risk and Compliance (GRC) Lead serves as the subject matter expert for firmwide Information Security GRC initiatives, collaborating closely with the Information Security Officer. This role encompasses the development, implementation and ongoing coordination of GRC efforts. The GRC Lead is responsible for tracking information security risks, conducting risk analyses and mitigation options, coordinating information security metrics, while regularly tracking and reporting to Information Security leadership. In addition, the Lead accepts duties to enforce GRC rigor globally for firmwide information security obligations. Additionally, this role involves implementing and advancing policies and a comprehensive control framework to execute the GRC strategy. The GRC Lead oversees the administration of standards and controls, risk management, third-party risk (TPRM), baseline security controls and technology compliance initiatives. The GRC Lead coordinates information security audits and assessments, including tracking, timely responses, and interactions with O’Melveny clients and external auditors. The GRC Lead will also assist with reviewing outside counsel guidelines. This position will also develop a third-party risk management program, and assist with reviewing third-party risk, utilizing tools as well as reviewing due diligence documentation, such as questionnaires and SOC reports.

This position requires a deep understanding of ISO/IEC 27001, risk management methodologies, technical controls, and a proactive approach to addressing both operational and strategic risks. The GRC Lead collaborates with a cross-functional team of information security and information technology analysts to evaluate controls, map them to key performance indicators, measure effectiveness and produce timely reports for management. These reports are essential for identifying, evaluating and reporting on cybersecurity risks that may impact the business, ensuring informed decision-making. Strong business acumen and a diverse technical background are crucial for understanding emerging technologies and legacy systems considered business critical. The GRC Lead reports to the Information Security Officer.

Remote applications will be accepted from candidates who reside in the following states: AL, AZ, CA, CO, D.C., FL, HI, ID, IL, LA, MD, MA, MN, MO, NC, NH, NV, NJ, NY, OH, OR, PA, SC, TX, UT, VA, WA, WV.

The salary range in California for this role is $125,000 - $165,000 and represents the firm’s good faith minimum and maximum range for this role at the time of posting. The actual compensation offered to a candidate will be dependent on a variety of factors including, but not limited to, the candidate’s experience, qualifications, and location.

Essential Duties And Responsibilities

• Lead firmwide Information Security GRC initiatives in partnership with the Information Security team.
• Assist and coordinate with the firm’s ISO 27001 annual re-certifications, as well as with client audits.
• Be familiar with external requirements, such as outside counsel guidelines, and assist with tracking, review, and response.Respond to these reviews in a timely manner.
• Oversee Information Security GRC activities and coordinate closely with the Information Security Officer.
• Serve as a subject matter expert and trusted advisor for leadership on Information Security GRC matters.
• Serve as the primary contact for responding to business unit inquiries regarding operational compliance.
• Collaborate with IT, legal, finance and operations to develop a cohesive Information Security GRC program.
• Partner with business units during solutions onboarding to ensure adequate controls are in place and enabled.
• Conduct regular risk assessments, analyzing emerging risks across the organization.
• Coordinate with stakeholders to implement effective risk mitigation strategies.
• Maintain a strategic and comprehensive GRC program that includes policies, standards, processes and guidelines.
• Stay updated on regulatory changes and industry standards, such as ISO, NIST, GDPR, HITRUST and HIPAA.
• Provide guidance to team members to ensure compliance with relevant laws and regulations.
• Deliver GRC reports to management, emphasizing compliance status, risk exposure and mitigation efforts.
• Oversee third-party and vendor risk as an integral part of the organization’s risk management strategy.
• Document, communicate and enforce cybersecurity standards that balance risk with business operations.
• Document GRC activities, policies, assessments and corrective actions to ensure audit readiness.
• Implement process improvements using GRC tools and methodologies to drive productivity gains.
• Cooperate with internal and external auditors to maintain and implement controls that meet GRC requirements.
• Motivate functional areas to implement practices that comply with cybersecurity policies and standards.
• Provide leadership in collaboration with technical and business teams to strengthen business resiliency.
• Guide team to align with security, audit and risk management efforts in ongoing security program assessments.

Knowledge, Skills, And Experience Preferred

• Five years of experience in GRC or a cybersecurity practitioner, including roles in security analysis, compliance, and risk management.
• Experience working in a distributed and hybrid office team.
• Understanding of information security and privacy frameworks:ISO/IEC 27001 is required, NIST, HIPAA, HITRUST, GDPR, and GLBA are optional.
• Bachelors degree in Cybersecurity, Computer Science, Data Science, or a related field.
• Experience conducting tabletop exercises, coordinating disaster recovery exercises, and other information security control tests is ideal.
• Excellent analytical and problem-solving abilities.
• Effective communication and interpersonal skills and ability to work independently and collaboratively in a multidisciplinary team environment.Excellent written and verbal communication skills.
• Candidate should be able to effectively interact with all levels of staff.
• Professional certifications are a plus (CISSP, CISM, CISA, CRISC or CGRC).
• Candidates must be internally motivated and self-driven for excellent results.
• Must have strong leadership skills, providing project leadership as needed, and excellent written and verbal communication skills.
• The ability to work in a team or work independently on complex tasks with minimal technical and management guidance is required.
• Must meet deadlines and deliver status updates to project team frequently.

We offer an excellent salary and benefits package.

For more information, or to be considered for this position, Response will be given to candidates who closely meet our qualifications.

EOE M/F/D/V. No phone inquiries please.