[Hiring] Manager, Information Security Assurance Services @Thrivent

Role Description

The Manager, Information Security Assurance Services is responsible for leading the design, build, and continuous maturation of the program. This role requires a proven track record of establishing and scaling information security assurance capabilities, including:

• Control frameworks
• Regulatory compliance
• Audit readiness
• Information security awareness
• Policy governance
• Third-party risk management
• Payment Card Industry Data Security Standards (PCI DSS)

This leader will oversee a team accountable for executing and evolving assurance processes, with a clear mandate to drive automation, standardization, and gain operational efficiency across all Assurance Services products and services. The role partners closely with business, technology, and regulatory stakeholders to ensure controls are effectively implemented, measured, and aligned to organizational risk tolerance and regulatory requirements.

The ideal candidate brings demonstrated experience building GRC programs from the ground up and advancing them to a mature, technology-enabled function, leveraging automation, integrated tooling, and data-driven insights to reduce manual effort, improve control effectiveness, and enhance transparency. This role will be responsible for executing the strategic direction, establishing scalable processes, and ensuring the team delivers consistent, high-quality outcomes that strengthen the organization’s overall security posture and resilience.

Qualifications

• Minimum 10 years of progressive experience across GRC, information security, technology risk, internal/external audit, controls, cybersecurity assurance, or closely related disciplines.
• Minimum 5 years of direct people leadership experience, including coaching, performance management, workforce planning, and talent development.
• Demonstrated experience operating within or directly supporting PCI DSS environments, including scope definition, control design, testing, remediation, evidence management, and QSA/ISA interaction.
• Strong working knowledge of governance and control frameworks including NYDFS Part 500, NIST Cybersecurity Framework, CIS Controls, and PCI DSS.
• Demonstrated experience designing, testing, and remediating IT general controls (ITGCs) and application-level controls.
• Proven ability to communicate complex risk and control topics clearly to executive audiences, audit committees, regulators, and cross-functional stakeholders.
• Ability to operate independently under limited direction, prioritize competing demands, and consistently deliver results in ambiguous, fast-moving environments.
• Bachelor's degree in Information Security, Computer Science, Information Systems, related discipline, or equivalent professional experience.

Requirements

• Experience implementing or operating ServiceNow Integrated Risk Management (IRM) or comparable GRC platforms (e.g., Archer, AuditBoard, OneTrust, MetricStream).
• Experience operating within a Product Operating Model, including roadmap planning, backlog grooming, sprint-based delivery, feature commitment management, and metrics-driven execution.
• Experience in financial services, banking, or other highly regulated industries, including direct interaction with regulators such as state banking authorities, the OCC, FDIC, or NYDFS.
• Industry certifications such as CISSP, CISA, CISM, CRISC, CGEIT, or CIA.
• Demonstrated success improving control automation, continuous control monitoring, assurance testing efficiency, audit-readiness practices, and evidence-as-code approaches.

Benefits

• Various bonuses (including, for example, annual or long-term incentives)
• Medical, dental, and vision insurance
• Health savings account
• Flexible spending account
• 401k
• Pension
• Life and accidental death and dismemberment insurance
• Disability insurance
• Supplemental protection insurance
• 20 days of Paid Time Off each year
• Sick and Safe Time
• 10 paid company holidays
• Volunteer Time Off
• Paid parental leave
• EAP
• Well-being benefits
• Other employee benefits