InfoSec & Privacy Program Manager (SOX & Risk)

Graham Holdings Company; Arlington (VA); Hybrid; USD 130,000 - 175,000; Full time

Benefits offered by this job

Competitive base salary

Comprehensive benefits package

401(k) plan + company pension

Tuition assistance

Paid vacation (4 weeks)

Adoption assistance

Job summary

Graham Holdings Company seeks a Manager, Information Security and Privacy to lead SOX ITGC testing, risk assessments, and enterprise security governance across a decentralized portfolio. You’ll work closely with portfolio tech teams, auditors, and leaders to translate complex findings into actionable guidance.

The role focuses on risk, assurance, and program quality, with hands-on operations, vulnerability management, AI governance support, and enterprise security awareness programs across the

Qualifications

• Bachelor's degree or equivalent in a related field.
• 6+ years in information security, IT risk, IT audit, or cybersecurity compliance in a complex enterprise.
• Demonstrated SOX ITGC testing, evidence collection, and external audit coordination.

Responsibilities

• Lead the annual SOX ITGC and application controls testing program with control owners at portfolio companies.
• Maintain the enterprise cybersecurity metrics program across portfolio companies and report material risk trends.
• Operate the enterprise vulnerability management program using Orca and Qualys, track remediation, and coordinate with tech teams.
• Coordinate cybersecurity risk assessments, identify gaps, and document remediation roadmaps.
• Plan tabletop incident response exercises and support real incident response activities.
• Execute third‑party and vendor risk assessments and manage vendor risk inventory.

Skills

Information security

IT risk management

IT audit

Cybersecurity compliance

SOX ITGC testing

Vulnerability management

GRC systems

Security metrics

Education

Bachelor's degree in accounting information systems, MIS, or related field

Tools

Orca

Qualys

Archer GRC

GRC tooling

Job description

Graham Holdings Company seeks a Manager, Information Security and Privacy to lead SOX ITGC testing, risk assessments, and enterprise security governance across a decentralized portfolio. You’ll work closely with portfolio tech teams, auditors, and leaders to translate complex findings into actionable guidance.

The role focuses on risk, assurance, and program quality, with hands-on operations, vulnerability management, AI governance support, and enterprise security awareness programs across the