Security Governance Manager

Alcor Solutions, Inc.; Raleigh (NC); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Alcor Solutions, Inc. is seeking a Security Governance Manager who will own the clients’ security policies, risk management and compliance program.

The role sits at the bridge of IT, security operations, legal, audit and business leadership, translating security requirements into clear policies, measurable controls and practical guidance. Responsibilities include policy development, risk management, audit coordination, security awareness, and regular reporting of KPIs to leadership.

Qualifications

• Bachelor's degree or equivalent work experience in information security, IT, business or related field.
• 3+ years of information security, IT, risk management, compliance, or audit experience.
• Knowledge of at least one security or compliance framework (e.g., NIST CSF, ISO 27001, SOC 2, CIS Controls).
• Experience writing or maintaining policies, procedures or technical documentation.
• Understanding core security concepts: access control, data protection, vulnerability management, incident response.
• Strong written and verbal communication skills; ability to explain technical topics to non-technical audiences.

Responsibilities

• Develop, maintain and review information security policies, standards and procedures.
• Communicate policy changes to staff and ensure accessibility and clarity.
• Manage policy exception process with documented approvals and compensating controls.
• Maintain the security risk register and lead risk assessments.
• Coordinate third-party/vendor security reviews before onboarding and on a recurring schedule.
• Map internal controls to frameworks and regulations and prepare for audits.

Skills

Policy development

Risk assessment

Regulatory compliance

Security governance

Communication skills

Education

Bachelor's degree in information security, IT, business or related field

Tools

ServiceNow GRC

Archer

Vanta

Drata

OneTrust

LogicGate

Job description

Certifications: CompTIA Security+, CISSP, CISM, CRISC, CISA or ISO 27001

Alcor Solutions is seeking to hire a Security Governance Manager who will own the clients security policies, risk management and compliance program, making sure security practices match business goals and regulatory obligations. The role is the bridge between IT, security operations, legal, audit and business leadership, turning security requirements into clear policies, measurable controls and practical guidance people can follow.

Policy and Standards

• Develop, maintain and review information security policies, standards and procedures at least annually.
• Communicate policy changes to staff and make sure policies are accessible and easy to understand.
• Manage the policy exception process, documenting approvals, and compensating controls.
• Maintain the security risk register and lead periodic risk assessments.
• Work with system and business owners to identify, rate and track remediation of security risks.
• Coordinate third-party / vendor security reviews before onboarding and on a recurring schedule.

Compliance and Audit

• Map internal controls to applicable frameworks (e.g., NIST CSF, ISO 27001, SOC 2, CIS Controls, and regulations such as HIPAA, PCI DSS or GLBA where relevant).
• Prepare for and coordinate internal and external audits, including evidence collection and responses to findings.
• Track audit findings and corrective action plans through closure.

Security Awareness and Culture

• Oversee the security awareness training program, including annual training and phishing simulations.
• Track completion rates and follow up with departments as needed.

Reporting and Program Oversight

• Report on the state of the security program, risk posture, and compliance status to leadership on a monthly or quarterly basis.
• Define and track key security metrics (KPIs/KRIs).
• Support business continuity, disaster recovery, and incident response planning, including tabletop exercises.
• Serve as the point of contact for security governance questions across the organization.
• Partner with IT, legal, HR, procurement and security operations to embed security into everyday processes.
• Stay current on emerging threats, regulatory changes and industry best practices.

Required Qualifications

• Bachelor's degree in information security, IT, business or related field, or equivalent work experience.
• 3+ years of experience in information security, IT, risk management, compliance, or audit.
• Working knowledge of at least one security or compliance framework (e.g., NIST CSF, ISO 27001, SOC 2, CIS Controls).
• Experience writing or maintaining policies, procedures or technical documentation.
• Understanding core security concepts: access control, data protection, vulnerability management, and incident response.
• Strong written and verbal communication skills, including explaining technical topics to non-technical audiences.
• Organized and able to manage several projects and deadlines at once.

Preferred Qualifications

None of these are required; they strengthen a candidate but are not barriers to entry.

• A security or governance certification such as CompTIA Security+, CISSP, CISM, CRISC, CISA or ISO 27001 Lead Implementer (or willingness to earn one within 12–18 months).
• Experience supporting an external audit or certification effort (SOC 2, ISO 27001, PCI DSS, HIPAA).
• Experience with GRC tools (e.g., ServiceNow GRC, Archer, Vanta, Drata, OneTrust, LogicGate) or managing compliance tracking in spreadsheets and ticketing systems.
• Experience leading or coordinating a security awareness program.
• Familiarity with cloud environments (Microsoft 365, Azure, AWS or Google Cloud).

Key Skills and Competencies

The ideal candidate should combine cybersecurity governance expertise, risk management, regulatory compliance, policy development, and strong leadership and communication skills. The role focuses on ensuring that security practices align with business objectives, regulatory requirements, and organizational risk tolerance.

Engagement Expectations

• Standard business hours, with occasional after-hours work during audits or incidents.
• Primarily office or remote computer-based work; occasional travel may be required.

Success Measures

• 30 days: Inventory existing policies, controls and compliance obligations; meet key stakeholders.
• 90 days: Stand up or refresh the risk register; publish a policy review schedule; deliver a first status report to leadership.
• 6 months: Core policies reviewed and approved; vendor review process in place; awareness training running.
• 12 months: Controls mapped to the chosen framework; audit findings tracked to closure; regular metrics reporting established.