Global Security Governance, Risk & Compliance Manager (Remote)

The Global Security GRC Manager is a senior program leader responsible for driving and sustaining governance, risk, and compliance across engineering, manufacturing, and corporate environments. Reporting to the CISO, this role leads a team of GRC professionals and owns the execution of major cross-functional initiatives like CMMC maturity, vendor risk, data protection, business continuity, and security culture. This leader operationalizes GRC strategy, ensuring controls are embedded across sites and supply chains in a manner that enables production uptime, engineering velocity, and customer confidence.

Core Responsibilities:

Program Ownership & Leadership

• Lead enterprise-wide IT execution of CMMC and other compliance program lifecycles, including scope definition, SSP/POA&M, evidence quality and refresh cadence, assessor coordination, corrective action closure, and site-level readiness
• Directly manage and develop a GRC team while coordinating control owners through a global matrix model
• Translate policy and strategic objectives into repeatable, standardized processes across plants, engineering teams, and corporate functions
• Drive remediation programs and create transparency into readiness, progress, and risk
• Mentor, prioritize workload, develop capability, and foster global collaboration
• Promote a supportive, performance-oriented culture of velocity, integrity, and teamwork
• Own preparation and participation in customer and third-party audits and security questionnaires
• Leverage AI technologies to reduce manual effort required to sustain the GRC program
• Maintain a business-impact view of risk, track remediation commitments, and escalate gaps to leadership
• Coordinate evidence, drive findings closure, establish sustainable corrective action plans

Security Culture

• Champion a global security culture in which we foster accountability and risk ownership
• Translate complex regulatory topics into clear expectations for employees
• Partner with HR and related stakeholders to deliver targeted training, awareness, and role-based education

Global Vendor Risk Management

• Manage the end-to-end vendor security risk lifecycle: assessments, risk treatment, remediation, and ongoing monitoring
• Operate supplier security expectations in partnership with key stakeholders
• Escalate systemic vendor risk trends and recommend course corrections to leadership

Data Protection

• Govern data protection requirements for IP, manufacturing processes, export-controlled data, and cloud workloads
• Validate consistent application of classification, DLP, access control, and retention standards

Business Continuity & Resilience

• Govern security and compliance aspects of BC/DR readiness across manufacturing, engineering, and corporate environments
• Define resilience-control requirements; validate that recovery playbooks, exercises, and evidence meet applicable regulatory, customer, and risk management obligations
• Partner with accountable technology and business service owners to verify timely closure of identified gaps

Qualifications:

• Minimum of 7 years of IT GRC, information security, or regulated compliance experience, preferably with 2 years managing a geographically diverse team
• Demonstrated ability to use generative AI and automation responsibly to improve analysis, evidence operations, knowledge management, and workflow efficiency; experience evaluating AI risk and governance preferred
• Defense experience strongly preferred

• Demonstrated experience with CMMC, NIST SP 800-171, and/or DFARS readiness and audit execution
• Strong oral and written communicator who can lead cultural changes, influence people and provide technical strategic direction
• Demonstrated problem solving and organizational skills; ability to work multiple programs at one time
• CISSP, CISM, CRISC, CGEIT, GRCP, CGRC, GSLC, PMP or other relevant certification preferred

Education Requirements:

• Bachelor's degree from an accredited college/university or equivalent experience