Information Security GRC Lead (Remote)

O'Melveny & Myers LLP; New York (NY); Remote; USD 125,000 - 165,000; Full time

Job summary

O’Melveny & Myers LLP seeks an Information Security GRC Lead to drive firmwide governance, risk and compliance initiatives. The role partners with the Information Security team to implement controls, assess risk, and coordinate third‑party risk management across the firm, including audits and client reviews.

The position supports remote work or based in any U.S. office, with responsibilities spanning policy development, metrics, and collaboration with legal, IT and business units to strengthen

Qualifications

• Five years of experience in GRC or cybersecurity, including security analysis, compliance, and risk management.
• Understanding of ISO/IEC 27001, NIST, HIPAA, HITRUST, GDPR, GLBA frameworks.

Responsibilities

• Lead firmwide Information Security GRC initiatives in partnership with the Information Security team.
• Assist with ISO 27001 annual recertifications and client audits.
• Oversee third-party and vendor risk management as part of risk strategy.
• Document, communicate and enforce cybersecurity standards for audit readiness.
• Collaborate with cross-functional teams to implement risk mitigation strategies.
• Produce timely GRC reports for management.

Skills

GRC expertise

Security analysis

Compliance

Risk management

ISO/IEC 27001

NIST framework

HIPAA knowledge

GDPR knowledge

CISSP/CISM/CISA/CRISC/CGRC

Communication skills

Education

Bachelor's degree in Cybersecurity

Bachelor's degree in Computer Science

Bachelor's degree in Data Science

Tools

GRC software

Job description

O’Melveny & Myers LLP seeks an Information Security GRC Lead to drive firmwide governance, risk and compliance initiatives. The role partners with the Information Security team to implement controls, assess risk, and coordinate third‑party risk management across the firm, including audits and client reviews.

The position supports remote work or based in any U.S. office, with responsibilities spanning policy development, metrics, and collaboration with legal, IT and business units to strengthen