InfoSec GRC Leader: Governance, Risk & Compliance

Servier; Boston (MA); On-site; USD 180,000 - 240,000; Full time

Job summary

Servier, a Boston-based biopharmaceutical company, seeks an Associate Director, Information Security Governance Risk & Compliance to lead the US GRC program. You will shape the governance framework, risk methodology, and maturity roadmap, overseeing risk management, policy governance, third-party risk, control assurance, and audit readiness.

The role partners with Global Information Security, Legal, Privacy, and business stakeholders to translate risk into business and regulatory impact,

Qualifications

• Leadership experience directing GRC programs in a US affiliate.
• Background in governance, risk and compliance for information security.
• Ability to translate risk into business, regulatory and financial implications.

Responsibilities

• Establish and lead the US information security risk management framework across the affiliate.
• Define risk assessment methodologies, risk taxonomy, scoring models and reporting standards.
• Provide oversight of risk assessments and ensure alignment with enterprise risk expectations.
• Drive risk-based remediation prioritization and control improvement initiatives.
• Coordinate governance routines, cadences and reporting for the US GRC function.
• Partner with Global Information Security, Legal, Privacy, Procurement and Internal Audit.

Skills

GRC leadership

Information security risk management

Policy governance

Third-party risk management

Stakeholder communications

Job description

Servier, a Boston-based biopharmaceutical company, seeks an Associate Director, Information Security Governance Risk & Compliance to lead the US GRC program. You will shape the governance framework, risk methodology, and maturity roadmap, overseeing risk management, policy governance, third-party risk, control assurance, and audit readiness.

The role partners with Global Information Security, Legal, Privacy, and business stakeholders to translate risk into business and regulatory impact,