Lead InfoSec Risk Manager, GRC & Audit (Hybrid)

SAS; Cary (NC); Hybrid; USD 140,000 - 190,000; Full time

Benefits offered by this job

401k plan

Tuition assistance

Generous vacation and holidays

Job summary

SAS is seeking a Manager, Information Security Risk – Governance, Risk, Compliance – Audit (GRC-A) to lead risk management programs in a hybrid Cary, NC environment. You will oversee risk assessments across SAS and third parties and guide the team in delivering independent risk insights.

In this working management role, partner with stakeholders across IT and business domains, monitor regulatory requirements (NIST CSF, PCI DSS, CIS Controls), and drive program execution with senior leadership.

Qualifications

• Bachelor’s or Master’s degree in Business, IT, Cybersecurity, Project Management or related field.
• ],
• job_responsibilities_description . . .
• CoT_job_summary_short
• job_responsibilities_description[]
• CoT_job_summary_short
• job_responsibilities_description

Responsibilities

• Lead and mature the information security risk management program and third-party risk assessments, guiding a team to improve risk management practices.
• Partner with business, technology, and service provider stakeholders to identify, assess, monitor, and manage information security risks.
• Monitor evolving regulatory requirements and incorporate them into program practices.

Skills

Risk management

Leadership

Stakeholder engagement

GRC tooling

Project management

Communication

Problem solving

Education

Bachelor’s or Master’s degree in Business, IT, Cybersecurity, Project Management or related field

Tools

ServiceNow IRM

Job description

SAS is seeking a Manager, Information Security Risk – Governance, Risk, Compliance – Audit (GRC-A) to lead risk management programs in a hybrid Cary, NC environment. You will oversee risk assessments across SAS and third parties and guide the team in delivering independent risk insights.

In this working management role, partner with stakeholders across IT and business domains, monitor regulatory requirements (NIST CSF, PCI DSS, CIS Controls), and drive program execution with senior leadership.