IT Risk Principal — GRC & Security Leadership

Workday; United States; Hybrid; USD 183,000 - 274,000; Full time

Benefits offered by this job

Bonus plan

Stock grants

Flexible work arrangements

Job summary

Workday’s BT Risk Management team within the CIO organization drives governance, risk, and compliance across security, cloud operations, IT, development, and infrastructure. The role partners with stakeholders to assess issues, define remediation actions, and set timelines for execution.

The candidate will lead GRC initiatives, strengthen audit strategies, and apply risk analysis methodologies while aligning with executive priorities and regulatory expectations.

Qualifications

• 12+ years leading GRC initiatives and maintaining GRC frameworks.
• Extensive experience ensuring compliance with applicable laws and regulations.
• Deep knowledge of cyber security governance and risk management.

Responsibilities

• Design, implement, and manage governance, risk, and compliance programs.
• Collaborate with Security, Cloud Operations, IT, and Business units to remediate gaps.
• Develop and track Outcome-Driven Metrics to measure program effectiveness.
• Lead change management and drive adoption of security practices across the org.
• Review and update compliance strategy in light of industry trends and regulations.

Skills

GRC leadership

Audit strategies

Cybersecurity governance

Risk analysis

Executive relationship building

Education

Bachelor's in Business Administration/Finance/InfoSec

Master's degree preferred

Tools

GRC platforms

Regulatory reporting tools

Job description

Workday’s BT Risk Management team within the CIO organization drives governance, risk, and compliance across security, cloud operations, IT, development, and infrastructure. The role partners with stakeholders to assess issues, define remediation actions, and set timelines for execution.

The candidate will lead GRC initiatives, strengthen audit strategies, and apply risk analysis methodologies while aligning with executive priorities and regulatory expectations.