Senior InfoSec Assurance Leader

Thrivent Financial; Northern (KY); On-site; USD 146,000 - 198,000; Full time

Job summary

Thrivent Financial seeks a seasoned Manager of Information Security Assurance Services to lead the design, build, and maturation of the program. You will drive governance, control design and testing, audit readiness, and policy management while scaling automation and data-driven insights across assurance services.

You will oversee governance, TPRM, PCI DSS program, and regulatory engagements, communicating with executives and regulators to strengthen security posture and resilience.

Qualifications

• Minimum 10 years of progressive experience across GRC, information security, technology risk, internal/external audit, controls, cybersecurity assurance, or closely related disciplines.
• Minimum 5 years of direct people leadership experience, including coaching, performance management, workforce planning, and talent development.
• Demonstrated experience operating within or directly supporting PCI DSS environments, including scope definition, control design, testing, remediation, evidence management, and QSA/ISA interaction.
• Strong working knowledge of governance and control frameworks including NYDFS Part 500, NIST Cybersecurity Framework, CIS Controls, and PCI DSS, with the ability to design and defend control rationale to auditors and regulators.
• Demonstrated experience designing, testing, and remediating IT general controls (ITGCs) and application-level controls.
• Proven ability to communicate complex risk and control topics clearly to executive audiences, audit committees, regulators, and cross-functional stakeholders.
• Ability to operate independently under limited direction, prioritize competing demands, and consistently deliver results in ambiguous, fast-moving environments.
• Bachelor's degree in Information Security, Computer Science, Information Systems, related discipline, or equivalent professional experience.

Responsibilities

• Lead program governance across assurance domains including controls design, testing, audit readiness, and policy governance.
• Serve as SME across information security assurance disciplines and contribute to control narratives and regulator engagements.
• Own and improve the control framework, mappings, and evidence model across standards like NYDFS Part 500, NIST CSF, CIS Controls, HIPAA, FDIC, and PCI DSS v4.x.
• Direct end-to-end audit and regulatory response, reviewing high-risk responses and evidence packages.
• Oversee PCI DSS program scope, strategy, and multi-year roadmap; coordinate ISA and AOC/ROC readiness.
• Mature the third-party risk management program including due diligence and monitoring.
• Own enterprise information security policy governance and lifecycle management.
• Drive security awareness strategy, training, assessments, and phishing simulations.
• Translate strategic priorities into roadmaps, OKRs, and execution plans with stakeholders.
• Lead and develop a multidisciplinary assurance team; manage performance and growth.
• Drive automation and continuous improvement of evidence collection and control testing.

Skills

GRC leadership

Executive communication

Automation mindset

Strategic planning

Vendor risk management

PCI DSS expertise

NYDFS Part 500

NIST CSF

Education

Bachelor's degree in Information Security, CS, IS, or related field

Tools

ServiceNow IRM

Archer

AuditBoard

OneTrust

MetricStream

Job description

Thrivent Financial seeks a seasoned Manager of Information Security Assurance Services to lead the design, build, and maturation of the program. You will drive governance, control design and testing, audit readiness, and policy management while scaling automation and data-driven insights across assurance services.

You will oversee governance, TPRM, PCI DSS program, and regulatory engagements, communicating with executives and regulators to strengthen security posture and resilience.