Information Security GRC Leader

Steptoe LLP; Washington (District of Columbia); Hybrid; USD 148,000 - 161,000; Full time

Benefits offered by this job

Medical, Dental, Vision

401K Plan

Profit-Sharing

Paid Time-Off

Wellness Program

Job summary

Steptoe LLP in Washington, DC, seeks a Manager of Information Security Governance, Risk & Compliance to lead the firm’s GRC program. You will partner with the Director of Information Security, OGC, IT and risk teams to ensure policies, controls and regulatory obligations align with client expectations and business objectives.

The role requires deep knowledge of security frameworks, with experience in the legal or professional services sector, and the ability to translate regulatory requirements

Qualifications

• Bachelor's degree in Information Security, Computer Science, Information Systems or related discipline.
• 7–10 years of information security experience, with at least 4 years in governance, risk and compliance.
• Experience supporting an ISO 27001 certified organization.
• Experience conducting enterprise security risk assessments and managing external audits.
• Strong understanding of security governance in a regulated professional services environment.
• Excellent written, presentation and stakeholder management skills.

Responsibilities

• Maintain and improve the firm's ISMS.
• Develop, review and maintain information security policies, standards, procedures and guidelines.
• Manage the firm's security governance framework and policy lifecycle.
• Prepare executive reporting and leadership-level metrics on cyber risk and compliance.
• Lead enterprise information security risk assessments and analyses for new technologies.
• Oversee third‑party risk assessments and vendor security reviews.
• Coordinate compliance with frameworks such as ISO 27001, ISO 22301 and client requirements.
• Coordinate internal and external audits and manage evidence collection.
• Develop and manage security awareness programs and phishing simulations.
• Collaborate with Security Operations, Security Engineering, Infrastructure and Legal teams to enforce controls and meet regulatory obligations.
• Drive continuous improvements and automation of governance and compliance activities.

Skills

Governance

Risk management

Compliance

Stakeholder management

Audits

Security awareness

Vendor risk management

Education

Bachelor's degree in Information Security

Bachelor's degree in Computer Science

Bachelor's degree in Information Systems

Tools

GRC tools

CrowdStrike Next-Gen SIEM

Microsoft 365 security ecosystem

Identity and Access Management

Vendor risk management platforms

Job description

Steptoe LLP in Washington, DC, seeks a Manager of Information Security Governance, Risk & Compliance to lead the firm’s GRC program. You will partner with the Director of Information Security, OGC, IT and risk teams to ensure policies, controls and regulatory obligations align with client expectations and business objectives.

The role requires deep knowledge of security frameworks, with experience in the legal or professional services sector, and the ability to translate regulatory requirements