Senior GRC & Information Security Leader

Sonypictures; Culver City, Northern (CA, KY); Hybrid; USD 142,000 - 178,000; Full time

Benefits offered by this job

Annual incentive

Comprehensive benefits

Job summary

Sony Pictures Entertainment is seeking a senior leader to own and advance enterprise Governance, Risk, and Compliance programs across the organization. You will drive PCI DSS, ISO 27001, privacy controls, and related security governance frameworks while partnering with IT, Legal, Privacy, and corporate functions.

The role focuses on automating control assessments, evidence collection, and reporting, developing policies, standards, and performance dashboards, and guiding ISMS activities and asset

Qualifications

• 5–7+ years of experience in cybersecurity GRC, compliance, risk management, audit, or security program management.
• Hands-on experience with PCI DSS, ISO 27001, SOC 2, NIST CSF or related standards.
• Experience leading compliance assessments, remediation management, and control validation activities.
• Experience developing and operationalizing security policies, standards, and governance processes.
• Familiarity with GRC and workflow platforms such as ServiceNow, AuditBoard/Optro, Smartsheet, or similar tools.
• Experience driving automation initiatives related to compliance operations, evidence collection, reporting, or continuous monitoring.
• Familiarity with AI-enabled workflows and automation technologies to improve operational scale and efficiency.
• Strong communication, stakeholder management, and relationship-building skills.
• Experience in entertainment, media, gaming, or streaming environments is highly desirable.
• Relevant certifications preferred (CISA, CISM, CRISC, CISSP, ISO 27001, PCI ISA)

Responsibilities

• Lead and manage enterprise cybersecurity compliance programs including PCI DSS, ISO 27001, privacy/security initiatives, and internal control frameworks.
• Lead and coordinate end-to-end compliance assessments including scoping, evidence collection, control testing, remediation tracking, and reporting.
• Partner with control owners and technical teams to assess control effectiveness and drive remediation activities.
• Develop dashboards, metrics, and executive reporting to communicate compliance status, risk trends, and program maturity.
• Identify opportunities to automate control assessments, evidence collection, reporting, and governance workflows using AI and automation technologies.
• Support continuous control monitoring and process improvements to increase operational efficiency and scalability.
• Develop, maintain, and modernize global information security policies, standards, and procedures.
• Drive policy governance activities, including stakeholder alignment, periodic reviews, approvals, exception management, and rollout communications.
• Collaborate with IT, Privacy, Legal, P&O, Production Security, and corporate functions to align security controls with organizational objectives.
• Support Sony Group information security governance initiatives, including ISMS performance reporting, Sony Group Critical Asset Program activities, and policy and standards development.
• Serve as a trusted advisor and relationship builder across technical and non-technical stakeholders.
• Monitor evolving cybersecurity, privacy, and compliance requirements and recommend program improvements.

Skills

GRC leadership

Cybersecurity governance

Stakeholder management

Policy development

Communication

Education

CISA, CISM, CRISC, CISSP (preferred)

Tools

ServiceNow

AuditBoard/Optro

Smartsheet

Job description

Sony Pictures Entertainment is seeking a senior leader to own and advance enterprise Governance, Risk, and Compliance programs across the organization. You will drive PCI DSS, ISO 27001, privacy controls, and related security governance frameworks while partnering with IT, Legal, Privacy, and corporate functions.

The role focuses on automating control assessments, evidence collection, and reporting, developing policies, standards, and performance dashboards, and guiding ISMS activities and asset