Head of Governance, Risk, and Compliance (GRC)
The Company Serving the People Who Serve the People Granicus is driven by the excitement of building, implementing, and maintaining technology that is transforming the Govtech industry by bringing governments and its constituents together. We are on a mission to support our customers with meeting the needs of their communities and implementing our technology in ways that are equitable and inclusive. Granicus has consistently appeared on the GovTech 100 list over the past 5 years and has been recognized as the best companies to work on BuiltIn. Over the last 25 years, we have served 5,500 federal, state, and local government agencies and more than 300 million citizen subscribers power an unmatched Subscriber Network that use our digital solutions to make the world a better place. With comprehensive cloud-based solutions for communications, government website design, meeting and agenda management software, records management, and digital services, Granicus empowers stronger relationships between government and residents across the U.S., U.K., Australia, New Zealand, and Canada. By simplifying interactions with residents, while disseminating critical information, Granicus brings governments closer to the people they serve—driving meaningful change for communities around the globe. Want to know more? See more of what we do here. Granicus is looking for a Head of Governance, Risk, and Compliance (GRC). Granicus is the largest cloud solutions provider for government and provides technology that empowers government organizations to create better lives for the people they serve. This role is a critical leadership position, reporting to the CISO, and responsible for enhancing and expanding Granicus’ GRC portfolio to improve the company’s overall security and compliance posture. As a global company that serves the public sector, Granicus is subject to and maintains compliance with myriad regulatory obligations, standards, and frameworks, including FedRAMP, NIST 800-53, ISO 27001, CJIS, PCI, GDPR, Cyber Essentials, SOC2, and others. The Head of GRC will lead all compliance efforts, working with all relevant partners (e.g., IT, Privacy, Legal) to ensure that all compliance obligations are understood, all relevant processes are fully established, and compliance is continuously tracked, measured, and reported on. Additionally, this role will lead the continuing maturation of Granicus’ risk management efforts, consisting of internal Risk Management and external Third-Party Risk Management programs. Candidates for this role must be collaborative in nature, acting as a true enabler of the business and partner to technology and other departmental leaders and teams, able to drive security outcomes through influence and partnership, and relentlessly focused on establishment of a security-first culture across the company. Additionally, candidates must have a strong, cross-discipline technical, security, and compliance background, as well as an ability to seamlessly move from deep, detailed conversations to executive level briefings, distilling challenging compliance, risk, and technical constructs in a digestible manner.
What your impact will look like:
- Lead all elements of compliance program encompassing all regulations Granicus is subject and attests to globally (e.g., policy and documentation, POA&M management, reporting), striving to keep Granicus compliant with ongoing obligations, particularly FedRAMP
- Act as primary Granicus point of contact to all auditors and regulators, leading all audit activity across the enterprise (e.g., FedRAMP and ISO 27001 annual audits)
- Lead, in partnership with CISO, the Risk Management program, including articulating cyber risks in a business context, their impacts, and recommending mitigation; lead all governance forums (e.g., Enterprise Risk Committee), and remediation activity governance and tracking.
- Mature Third Party Risk Management program to encompass all relevant elements (e.g., initial assessments, continuous monitoring)
- Maintain, mature, and create Information Security policies
- Formalize and operationalize Information Security exception process and provide continuous governance
- Support needs of customer-facing organizations as appropriate, which may include review of contractual elements pertaining to security, completing questionnaires, etc.
- Stay current with emerging regulatory and compliance requirements and continuously assess impact to Granicus; work with senior leaders to ensure that any impacts and associated work to remain compliant is included in Product and Technology roadmaps.
- Participate in or lead security efforts related to M&A, particularly post-acquisition activities to fully integrate acquired entity into all GRC processes.
You'll love this job if you have:
- Bachelors and/or Masters degree in Computer Science, Cyber Security, Information Technology, Risk Management, or related field
- 5+ years of cross-discipline Information Security/Information Technology experience
- 5+ years of leading a GRC function
- Demonstrated expert level understanding and experience with NIST 800-53 and FedRAMP, including interaction with Joint Authorization Board and/or sponsoring Federal Agencies.
- Broad knowledge of common standards, frameworks, and regulatory requirements.
- Demonstrated experience with representing security controls to external auditors and/or customers.
- Excellent executive presentation and communication skills.
- Ability to lead through influence, including at executive levels.