Manager, Security Governance Risk and Compliance (GRC)

Alvarez & Marsal Deutschland GmbH; Tampa (FL); On-site; USD 110,000 - 130,000; Full time

Job summary

A dynamic consulting firm is seeking a skilled Information Security Risk Manager to lead their global security risk management program. This pivotal role involves overseeing risk governance, managing senior-level reporting, and driving key initiatives across the organization. Candidates should possess a strong understanding of ISO 27001 security controls and have hands-on experience with GRC tools. The firm fosters a culture of independent thinkers and offers a collaborative environment with ample opportunities for professional growth. Join this innovative team to make a significant impact on security compliance and risk management strategies.

Benefits

Healthcare Plans

401(k) Retirement Savings Plan

Paid Time Off

Flexible Spending Accounts

Life Insurance

Disability Coverage

Qualifications

• Experience in Information Security risk management and compliance is essential.
• Strong understanding of ISO 27001 security controls is required.

Responsibilities

• Lead the information security risk management process and ensure risks are identified and mitigated.
• Provide oversight during security incidents and guide the organization’s response.

Skills

Information Security Risk Management

Governance and Compliance

Leadership in Risk Management

Analytical Skills

Communication Skills

Education

Relevant Senior Security Certifications (CISSP, CISM, etc.)

Tools

OnSpring GRC Tool

Job description

Manager, Security Governance Risk and Compliance (GRC)

Location: Tampa, FL, United States
Date Posted: Apr 18, 2025

Manager, Security Governance Risk and Compliance (GRC)

Alvarez & Marsal (A&M) is a global consulting firm with over 10,000 entrepreneurial, action and results-oriented professionals in over 40 countries. We take a hands-on approach to solving our clients' problems and assisting them in reaching their potential. Our culture celebrates independent thinkers and doers who positively impact our clients and shape our industry.

The Team
Alvarez and Marsal Global Security Office is committed to delivering the highest standards of security and compliance. We are seeking a highly skilled and motivated Information Security Risk Manager to lead A&M's wide information security risk management program and join our dynamic and growing team based in either our London or Tampa office.

How you will contribute
The Information Security Risk Manager will play a critical role in driving risk strategy, overseeing risk governance, managing senior-level reporting, and leading key information security risk initiatives across Alvarez and Marsal.

This role will focus on managing and maintaining the Global Security Office Information Security Risk Register, its supporting processes, governance, and reporting requirements. The successful candidate requires a strong understanding of ISO 27001 security controls, exposure to the OnSpring GRC Tool, and the ability to effectively assess and communicate technical security requirements to teams across the firm.

Risk Management Leadership and Oversight:

• Work to A&M Policy and industry standards and lead the end-to-end information security risk management process, ensuring risks are proactively identified, assessed, recorded, and mitigated.
• Assess and prioritize security risks based on enterprise-wide impact, likelihood, and mitigation strategies.
• Act as a trusted security advisor, working cross-functionally with IT, legal, compliance, Internal Audit, AI Centre of Excellence, and other business leadership teams to drive a culture of risk awareness.
• Ensure that all security risks align with regulatory requirements such as ISO 27001, NIST, GDPR, and other international security frameworks.
• Provide oversight and work closely with risk owners to manage the development and implementation of treatment plans to address identified risks, ensuring alignment with senior leadership expectations and business objectives.

GRC Tool Management:

• Own, manage, and continuously develop A&M GRC platform to provide a structured, scalable risk register and reporting capabilities to support A&M wide requirements, and support ISO 27001:2022 certification requirements.
• Complete annual formal risk assessment including control maturity assessment and asset register revision.
• Work closely with Internal Audit to ensure audit compliance and delivery for ISO 27001.
• Support ownership of minor non-conformities log of internal and external audit findings through to reporting, remediation, and closure.
• Attend ISO 27001 external audits for InfoSec Risk Management related compliance requirements.
• Organize and facilitate bi-weekly Global Security Office Risk Management meetings, providing comprehensive tracking and updates on risk triage activities, critical risk register changes, and general risk reporting mitigation strategies.
• Prepare and deliver quarterly risk updates to the Information Security Steering Committee and executive leadership, providing strategic insights in information security against A&M Security Objectives.
• Support risk input to bi-annual Executive Security Management Reviews.

Support Global Security Office SOC on Incident Response Leadership:

• Provide GRC oversight during security incidents, guiding the organization’s response and ensuring effective risk mitigation and reporting.

Qualifications

• Experience in Information security risk management, governance, and compliance.
• Proven leadership in enterprise risk management and security governance frameworks.
• Hands-on exposure to GRC tools.
• Background knowledge of risk assessment methodologies and security frameworks such as ISO 27001, NIST, and CIS.
• Experience managing and directing enterprise-wide Information Security risk triage, risk recording, treatment planning, and reporting.
• Ability to translate complex security risks into actionable business strategies for executive stakeholders.
• Strong analytical, strategic thinking, and decision-making skills.
• Excellent written and verbal communication skills, with demonstrated experience presenting risk insights to executive leadership and board members.
• Relevant senior security certifications (e.g., CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor) are highly desirable.

Your journey at A&M

We recognize that our people are the driving force behind our success, which is why we prioritize an employee experience that fosters each person’s unique professional and personal development. Our robust performance development process promotes continuous learning, rewards your contributions, and fosters a culture of meritocracy. With top-notch training and on-the-job learning opportunities, you can acquire new skills and advance your career.

We prioritize your well-being, providing benefits and resources to support you on your personal journey. Our people consistently highlight the growth opportunities, our unique, entrepreneurial culture, and the fun we have together as their favorite aspects of working at A&M. The possibilities are endless for high-performing and passionate professionals.

Regular employees working 30 or more hours per week are also entitled to participate in Alvarez & Marsal Holdings’ fringe benefits consisting of healthcare plans, flexible spending and savings accounts, life, AD&D, and disability coverages at rates determined periodically as well as a 401(k) retirement savings plan. Provided the eligibility requirements are met, employees will also receive an annual discretionary contribution to their 401(k) retirement savings plan from Alvarez & Marsal. Additionally, employees are eligible for paid time off including vacation, personal days, seventy-two (72) hours of sick time (prorated for part-time employees), ten federal holidays, one floating holiday, and parental leave. The amount of vacation and personal days available varies based on tenure and role type.

The salary range is $110,000 - $130,000 annually, dependent on several variables including but not limited to education, experience, skills, and geography. In addition, A&M offers a discretionary bonus program which is based on several factors, including individual and firm performance.

Diversity & Inclusion

A&M’s entrepreneurial culture celebrates independent thinkers and doers who can positively impact our clients and shape our industry. The collaborative environment and engaging work—guided by A&M’s core values of Integrity, Quality, Objectivity, Fun, Personal Reward, and Inclusive Diversity—are the main reasons our people love working at A&M.

Equal Opportunity Employer

It is Alvarez & Marsal’s practice to provide and promote equal opportunity in employment, compensation, and other terms and conditions of employment without discrimination because of race, color, creed, religion, national origin, ancestry, citizenship status, sex or gender, gender identity or gender expression (including transgender status), sexual orientation, marital status, military service and veteran status, physical or mental disability, family medical history, genetic information or other protected medical condition, political affiliation, or any other characteristic protected by and in accordance with applicable laws.