Manager, IT Governance, Risk & Compliance

About The Institutes Located in beautiful Malvern, Pennsylvania, The Institutes® are a not-for-profit comprised of diverse affiliates that educate, elevate, and connect people in the essential disciplines of risk management and insurance. Through products and services offered by our nearly 20 affiliated business units, people and organizations are empowered to help those in need with a focus on understanding, predicting, and preventing losses to create a more resilient world. Additionally, we understand the importance of work-life balance—in 2026 Philly.com named us a Top Workplace for the eleventh year and USA Today named us a USA Top Workplace for the fourth year. We provide excellent benefits and a friendly, team-focused work environment to drive employee engagement. Manager, IT Governance, Risk & Compliance The Manager, IT Governance, Risk & Compliance leads The Institutes' governance function for cybersecurity, risk management, compliance, business continuity and disaster recovery (BCDR), third-party risk management (TPRM), and AI governance. This is a governance and assurance orchestration role, and a highly collaborative one: the Manager sets standards, reviews and signs off on controls, and aggregates and leverages the work of cybersecurity technical experts, managed service providers, engineering leadership, internal legal and risk management staff, and the CIO to ensure security, AI, and data governance operate as one coherent program. Hands-on technical security engineering resides with those partners, not with this seat. The role is the primary point of accountability for the enterprise Third-Party Risk Management program: vendor risk governance, AI and third-party risk analysis, contractual data governance review in partnership with General Counsel, and vendor risk analytics and reporting. Execution is shared with staff, managed services, and platform workflows; the Manager coordinates, assures, and reports on that work. The Manager governs the security program against the NIST CSF 2.0 framework, holds the MDR relationship and the broader security tool portfolio accountable to defined outcomes in partnership with engineering leadership, and embeds risk stewardship into the IT delivery model through risk-tiered gates rather than after-the-fact control. The role is the governance owner for enterprise AI use, including agentic development guardrails and the citizen developer program, working closely with the CIO on enterprise AI policy. Essential Responsibilities Assure alignment of the enterprise security program to NIST CSF 2.0: set the control baseline, review and sign off on control implementation and maturity assessments, and maintain the remediation roadmap for unimplemented controls, with execution by engineering teams and managed services. Direct and assure daily cybersecurity operations through the managed detection and response (MDR) relationship: hold the provider to defined service levels; review alert triage, escalation, threat intelligence, and vulnerability management outputs; and sign off on remediation closure. Serve as the primary point of accountability for incident response governance: ensure security incidents are investigated end to end by the MDR partner and engineering leadership, and sign off on incident documentation, after-action reviews, and improvement actions. Serve as the primary point of accountability for the Third-Party Risk Management (TPRM) program: maintain vendor tier classifications and risk profiles; review and distribute security questionnaires; collect and analyze SOC reports, cyber insurance documentation, and compliance artifacts; track vendor remediation items to closure; and research vendor markets to surface emerging risks and trends — coordinating execution across staff, managed services, and platform workflows. Lead AI and third-party risk analysis: conduct AI-focused vendor risk assessments covering model usage, training data sources, and data retention practices; maintain an AI risk scoring methodology; assess model risk exposure (bias, explainability, regulatory considerations); detect and mitigate Shadow AI usage; track vendor data exposure and data-sharing pathways; and operate TPRM/AI governance platform workflows (e.g., OneTrust). Coordinate contractual data governance risk review in partnership with General Counsel: evaluate AI/data-related clauses in vendor contracts — data ownership, data residency, model training rights, sub-processor disclosures, and AI indemnification and liability language — and provide risk review during vendor onboarding and renewals in partnership with the IT portfolio function. Provide vendor risk analytics and executive reporting: risk dashboards, AI vendor exposure, data risk trends, model risk concentration, and systemic risk patterns across vendor categories. Govern the security tool portfolio and consolidation roadmap (endpoint, DSPM, data protection, backup/recovery, SIEM, MDR, and Microsoft security stack), recommending portfolio decisions to the CIO with technical evaluation led by engineering leadership. Lead BCDR governance: ensure business continuity and disaster recovery plans are maintained, tested, and continuously improved through managed-service and engineering partners, and sign off on test results and recovery validation. Manage audits, reviews, and assessments of information systems; lead cross-functional teams through external audits and maintain compliance documentation and evidence; and manage outsourced assessor independence, ensuring assessment and remediation vendors are appropriately separated and evaluated against program objectives. Develop, implement, and maintain security policies, procedures, and guidelines according to NIST best practices, in consultation with engineering leadership and General Counsel. Own AI governance operations: tool allowlists, coding-standard security requirements, citizen developer guardrails, application admin-consent review, and the risk register for AI-enabled tools — partnering with the CIO on enterprise AI policy direction. Build and develop risk review at risk-tiered delivery gates in partnership with engineering leadership, making gate decisions within delegated authority. Ensure delivery of security awareness and training programs to educate employees about information security best practices. Prepare cybersecurity and third-party risk reporting for executive leadership, and support the CIO in Board-level reporting. Perform employee evaluations and reviews for direct reports, documenting as necessary. Other Responsibilities Stay updated on information security threats, trends, and technologies, and recommend posture improvements. Coordinate and evaluate security testing and penetration testing with third-party vendors. Other duties as assigned. Required Competencies Risk Management and Governance Control Assurance and Sign-Off Third-Party and AI Risk Analysis Program Orchestration and Cross-Functional Collaboration Decision Making Leadership Communication Analytical Thinking Relationship Building Enterprise Perspective Technical Fluency (sufficient to direct managed security services and critically evaluate technical recommendations) Executive-Ready Reporting Employee Development Strive to reflect our five cultural values in all efforts: Put the Customer First, Do What You Say, Work Together, Be Innovative and Do the Right Thing. Education and Experience Bachelor's degree in information technology, business, risk management, computer science, or equivalent experience. Minimum 8 years of experience in IT governance, risk, compliance, audit, or technical program and analysis leadership across IT infrastructure and software development environments. Minimum 3 years leading a governance, risk, compliance, or assurance function, team, or cross-functional program. Demonstrated experience managing audits and control frameworks (NIST CSF or comparable), including evidence management, control review and sign-off, and coordination of external assessors and security or compliance vendors. Demonstrated experience with third-party risk management, including vendor risk assessment, security questionnaire processes, SOC report analysis, and contract risk review; familiarity with TPRM/governance platforms (e.g., OneTrust) preferred. Working technical fluency across IT infrastructure, cloud environments (AWS and Microsoft stack), and software delivery sufficient to direct managed security services and critically evaluate engineering and vendor recommendations; hands-on security engineering experience and security certifications are not required. Effective hands-on use of LLM-based tools to manage the research and analysis demands of the role. Experience governing AI/ML or agentic technologies preferred; governance and risk certifications (e.g., CRISC, CISA, CGEIT) a plus. The Best Part? The Benefits! To enforce the importance of work-life balance, employees enjoy excellent benefits, including: 401(k) plan with company contribution up to 16% Generous time off package that includes paid vacation, personal, sick, and holidays Paid maternity and parental leave Tuition reimbursement Medical, dental, vision, and prescription coverage On our Malvern campus: Free lunch every day when working on campus, onsite fitness center, and a beautiful 1.25-mile walking path!