Senior GRC Leader: Cybersecurity Risk & Compliance

VSE; Bedford (NH); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid schedule

Office in Bedford, NH

Job summary

VSE seeks a Governance, Risk and Compliance Leader to own the GRC program reporting to the CISO. You will architect the program using NIST CSF 2.0, define target profiles, and deliver a prioritized road map to close gaps while maintaining policy libraries and risk registers.

You will lead audits, third-party risk, and support CMMC/NIST SP 800-171 for defense customers, building a team as the function grows, and coordinating with Legal on contract risk.

Qualifications

• Bachelor’s degree in information security, information technology, computer science, or related field.
• 7 years of experience in information security, IT risk, or IT audit, including 3+ years building or leading a GRC program.
• Experience building a security program on NIST CSF or ISO/IEC 27001, including current state assessment, target state definition, remediation roadmap, and cross-framework mapping.
• Experience owning a risk register, a policy library, and a policy exception process.
• Experience completing security questionnaires (SIG, CAIQ or similar) and maintaining a response library.

Responsibilities

• Run the cybersecurity GRC program end to end, as directed by the CISO, including priorities, resourcing and rhythm.
• Maintain NIST CSF 2.0 current and target profiles with control owners across IT, Legal, HR, Finance, and operations.
• Lead responses to inbound security questionnaires and due diligence requests from customers and partners.
• Maintain the risk register and policy library, including risk scoring, treatment plans and owners.
• Define, track and report GRC metrics to the CISO and leadership.

Skills

NIST CSF

ISO 27001

GRC leadership

risk register

policy management

security questionnaires

contract review

stakeholder influence

CMMC

NIST SP 800-171

SOX ITGC

AI governance

Education

Bachelor’s degree

Tools

ServiceNow IRM

AuditBoard

Archer

LogicGate

OneTrust

Job description

VSE seeks a Governance, Risk and Compliance Leader to own the GRC program reporting to the CISO. You will architect the program using NIST CSF 2.0, define target profiles, and deliver a prioritized road map to close gaps while maintaining policy libraries and risk registers.

You will lead audits, third-party risk, and support CMMC/NIST SP 800-171 for defense customers, building a team as the function grows, and coordinating with Legal on contract risk.