Strategic GRC Leader: Risk, Compliance & Audit

NY CREATES; City of Albany (NY); On-site; USD 120,000 - 160,000; Full time

Job summary

NY CREATES in Albany, NY seeks a Senior Governance, Risk, and Compliance Specialist to lead the GRC program across the organization, maturing risk assessments, policy governance, and audit activities.

The role drives quantitative risk analysis, controls mapping to NIST/CMMC, and executive risk reporting, partnering with IT, security, and operations to ensure regulatory compliance and ongoing risk reduction.

Qualifications

• Six years of progressive GRC, risk management, or cybersecurity compliance experience, with at least four years in a senior or lead role.
• Bachelor's degree in Cybersecurity, Risk Management, Business Administration, Law, or related field; Master's or JD preferred.

Responsibilities

• Lead enterprise risk assessment program: design methodology, facilitate workshops, quantify likelihood and impact, and maintain dynamic risk register with residual risk tracking and KRIs.
• Own third‑party risk management framework: develop tiering model, author due diligence questionnaires, lead evidence reviews, negotiate contractual security clauses, and enforce continuous monitoring via automated feeds.
• Architect and govern cybersecurity policy hierarchy: author, socialize, and enforce policies, standards, and procedures; ensure traceability to NIST 800-53, CMMC 2.0, and CIS Controls.
• Design and execute internal cybersecurity audit program: scope annual plan, perform control testing, issue findings with root cause analysis, and validate remediation effectiveness.
• Strategize and scale training and awareness program: develop role-based curriculum, integrate phishing simulations, measure cultural maturity, and report behavioral risk trends to leadership.
• Produce integrated GRC dashboards and board-level reports: risk heatmaps, compliance posture, control effectiveness, vendor risk exposure, and audit readiness.
• Lead preparation for external assessments: CMMC Joint Surveillance, DIBCAC audits, and insurance cyber risk evaluations; serve as primary contact.
• Implement and administer enterprise GRC platform: configure risk, policy, vendor, and audit modules; automate workflows, evidence collection, and reporting.
• Chair risk committee meetings: present new risks, challenge mitigation plans, and secure executive approval for risk acceptance or treatment strategies.
• Drive GRC process automation and integration with ITSM, SOAR, and CMDB for real-time compliance visibility and control validation.
• Mentor Junior GRC Specialist and cross-functional control owners; establish GRC Center of Excellence and internal audit training pathways.
• Critical thinking to perform scenario-based risk analysis, challenge assumptions, and align compliance with mission objectives.

Job description

NY CREATES in Albany, NY seeks a Senior Governance, Risk, and Compliance Specialist to lead the GRC program across the organization, maturing risk assessments, policy governance, and audit activities.

The role drives quantitative risk analysis, controls mapping to NIST/CMMC, and executive risk reporting, partnering with IT, security, and operations to ensure regulatory compliance and ongoing risk reduction.