Senior Information Security Risk Manager - GRC & Audit

Sas; Cary (NC); Hybrid; USD 140,000 - 180,000; Full time

Benefits offered by this job

Comprehensive medical, prescription, –

401k plan

Tuition Assistance Program

Paid holidays

Winter Wellness Break

Volunteer Time Off

Parental leave

Generous childcare benefits

Job summary

SAS in Cary, North Carolina, seeks a hands-on Manager, Information Security Risk – Governance, Risk, Compliance – Audit. You will lead the risk program across SAS and third parties, mentor a team, and drive risk analysis, remediation, and continuous improvement in a dynamic, hybrid environment.

This role requires deep knowledge of NIST CSF, ERM, and regulatory requirements, with strong leadership and collaboration across business, technology, and procurement.

Qualifications

• Bachelor’s or Master’s degree in a related field.
• 4–8 years of demonstrated success in risk management.
• Strong management and leadership skills.
• Familiarity with GRC tooling such as ServiceNow IRM.
• Ability to manage multiple projects and train staff.

Responsibilities

• Lead and mature information security risk management programs and third-party risk assessments.
• Partner with stakeholders to identify, assess, monitor, and manage information security risks.
• Monitor regulatory and industry requirements and integrate them into program practices.
• Perform risk assessments and document threats, vulnerabilities, controls, and residual risks.
• Oversee risk treatment plans with clear ownership and timely remediation.
• Define and communicate risk metrics, KRIs, dashboards, and senior leadership reports.

Skills

Information security

Risk management

GRC

Leadership

Regulatory awareness

Education

Bachelor’s or Master’s degree in Business, IT, Cybersecurity, Project Management or related field

Tools

ServiceNowIRM

Job description

SAS in Cary, North Carolina, seeks a hands-on Manager, Information Security Risk – Governance, Risk, Compliance – Audit. You will lead the risk program across SAS and third parties, mentor a team, and drive risk analysis, remediation, and continuous improvement in a dynamic, hybrid environment.

This role requires deep knowledge of NIST CSF, ERM, and regulatory requirements, with strong leadership and collaboration across business, technology, and procurement.