Sr Principal, GRC

ingrammicro; Irvine (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Ingram Micro is seeking a Sr Principal for the Governance, Risk, and Compliance (GRC) organization to lead the cybersecurity governance framework and enterprise risk program in Irvine, CA. You will drive risk assessment, remediation planning, and third‑party risk management, collaborating with legal, procurement, IT, and business leaders.

The role requires deep expertise in PCI, SOX, SOC 1/2, ISO 27001, and related controls, plus vendor contracts and risk language.

Qualifications

• 4-year college degree in MIS/CS/Business/Engineering or related field.
• At least 10 years of experience in information security, risk management, IT audit, or governance.
• PCI DSS/PIN/P2PE expertise; PCI-QSA certification preferred.
• Experience with SOX, SOC 1/2, ISO 27001, PCI DSS, CMMC, FedRAMP, HITRUST.
• Vendor risk management and contract reviews.

Responsibilities

• Develop, implement, and maintain cybersecurity governance frameworks, policies, and procedures.
• Lead enterprise risk management; maintain risk register and remediation tracking.
• Design and manage Third-Party Risk Management program with due diligence and contracting.
• Conduct compliance/audit reviews per SOX, SOC, ISO, PCI, and related frameworks.
• Prepare evidence and remediation follow-up for audits.
• Collaborate with legal, procurement, and IT for risk awareness and responsibility.
• Advise stakeholders on PCI DSS/P2PE compliance strategies and risk exposure.
• Monitor regulatory changes and update risk/compliance strategies.

Skills

Cybersecurity governance

Risk management

Information security

IT audit

Contract language

Vendor management

Communication to executives

Education

Bachelor's degree in MIS/CS/Business/Engineering

Job description

Ingram Micro is looking for a Sr Principal for the Governance, Risk, and Compliance (GRC) organization.

This position is responsible for creating and maintaining a cybersecurity governance framework, managing risk through an enterprise risk register, tracking remediation for identified risk, and creating and maintaining an effective third-party risk management program (planning, due diligence, contract, transition, on-going monitoring, and exit). The position will also be responsible for performing compliance reviews, developing detailed audit/compliance programs, executing audit/compliance programs steps, analyzing results and communicating results to the senior management.

This position will work closely with business leaders and managers to ensure awareness and understanding of third-party risk program requirements and associated risk within their portfolios.

The ideal candidate will have a background in contract language, contract management, vendor management, vendor negotiations, risk management, and internal audit.

Your role:

• Develop, implement, and maintain cybersecurity governance frameworks, policies, and procedures.
• Lead the enterprise risk management process, including maintaining the risk register, facilitating risk assessments, and tracking remediation efforts
• Design and manage an effective Third-Party Risk Management (TPRM) program, including due diligence, contracting, onboarding, monitoring, and offboarding.
• Conduct compliance and audit reviews in accordance with regulatory frameworks such as SOX, SOC 1, SOC 2, NIST CSF, PCI DSS/PIN/P2PE, ISO 27001, CMMC and SWIFT.
• Develop audit and compliance testing procedures and communicate findings and recommendations to senior management.
• Collaborate with legal, procurement, IT, and business leaders to ensure awareness and understanding of risk program requirements and responsibilities.
• Complete required PCI-related training and serve as the subject matter expert (SME) for PCI DSS/PIN/P2PE, advising stakeholders on compliance strategies, risks, and security best practices.
• Provide expert guidance on vendor contracts, contract language, and risk-related clauses to minimize exposure.
• Monitor changes in the regulatory environment and recommend updates to compliance and risk strategies accordingly.
• Support the execution of internal and external audits, including preparation, evidence gathering, and remediation follow-up.

What you bring to the role:

• Possess a highly specialized level of technical expertise or business acumen. Extensive breadth and depth of knowledge arrived through exposure to emerging technical advancements or complex business situations.
• 4 Year College Degree in a related field (Management Information Systems, Computer Science, Business Management, Finance, Engineering, etc.) required
• Minimum 10 years of functional experience including a minimum of 7 years of relevant work experience in information security, risk management, IT audit, technical writing, or information security governance
• Demonstrated knowledge and experience with PCI compliance requirements and implementation. Current PCI-QSA certification preferred (will consider former QSA)
• Experienced in applying and interpreting various IT audit and compliance frameworks, including but not limited to SOX, SOC 1, SOC 2, ISO 27001, PCI DSS, CMMC, FedRAMP, and HITRUST. Proven ability to develop and execute audit and compliance programs.
• Experience with third-party risk management, contract reviews, and vendor risk assessments.
• Technical leader with an understanding of cloud technologies, API systems, infrastructure, network, and mobile security.
• Knowledgeable in current and emerging artificial intelligence technology trends, governance, risks, and implementation best practices.
• Ability to work in complex environments effectively, independently, and collaboratively within a team environment.
• Relevant certifications such as CISA, CFE, CISSP, CRISC, or CIA are a plus.

The ideal candidate will also have one or more of the following skills and/or qualifications:

• Cybersecurity risk management experience
• Experience managing a risk register
• Experience managing the risk exception process
• Experience creating remediation plans for cyber risks
• Experience creating presentations for al