[Hiring] Manager, Governance, Risk & Compliance @Vocate Education Solutions

Role Description

The Manager, Governance, Risk & Compliance (GRC) is responsible for leading and advancing the institution’s governance, risk management, compliance, and information security programs to support the achievement of organizational objectives and regulatory requirements. This role develops, implements, and monitors frameworks, policies, controls, and risk mitigation strategies that promote operational effectiveness, safeguard institutional assets, and ensure compliance with applicable laws, regulations, accreditation standards, and internal policies. The Manager partners with leaders across the institution to foster a culture of accountability, risk awareness, and continuous improvement in support of the institution’s mission and long-term success.

The Manager also provides hands-on leadership for key information security programs, including:

• Vulnerability management
• Third-party risk management
• Security performance reporting
• Policy governance
• Continuous improvement of security controls and operational practices

What You’ll Do

• Lead Governance, Risk, and Compliance Programs
• Conduct Cybersecurity and Technology Risk Management Activities
• Oversee Regulatory and Compliance Requirements
• Manage Security Governance and Architecture Oversight
• Manage the Vulnerability Management Program
• Lead Third-Party Information Security Risk Management
• Lead AI Governance Initiatives
• Coordinate Compliance and Control-Assurance Activities
• Monitor and Report on Risk and Compliance Performance
• Manage Policy Development and Governance Processes
• Monitor the Regulatory and Threat Landscape
• Drive Continuous Improvement
• Develop and Deliver Security Awareness Training
• Lead with Care
• Perform other duties as assigned

Qualifications

• Bachelor’s degree in cybersecurity, information security, information systems, computer science, risk management, business administration, or a related field, or an equivalent combination of education and relevant professional experience.
• Progressive experience in information security governance, cybersecurity risk management, regulatory compliance, security assurance, or a related discipline.
• Experience leading and developing team members or directing complex, cross-functional information security and GRC programs and initiatives.
• Experience managing or supporting a vulnerability management program, including vulnerability assessments, patch and remediation coordination, risk-based prioritization, exception management, validation, and performance reporting.
• Experience conducting third-party information security and privacy risk assessments and evaluating vendor controls, audit reports, certifications, contractual requirements, and remediation plans.
• Working knowledge of recognized cybersecurity frameworks and standards, including the NIST Cybersecurity Framework, applicable NIST Special Publications, CIS Critical Security Controls, and other relevant risk and control frameworks.
• Technical understanding of cloud environments, identity and access management, endpoint security, network security, vulnerability management, data protection, logging and monitoring, application security, and software-as-a-service platforms.
• Experience developing meaningful information security and GRC metrics, key performance indicators, key risk indicators, dashboards, and executive-level reporting.
• Experience creating, reviewing, maintaining, and implementing information security, privacy, risk-management, and technology policies, standards, and procedures.
• Experience monitoring cybersecurity, privacy, breach-notification, and data-protection requirements and partnering with Legal and Compliance to translate applicable requirements into operational and technical controls.
• Experience using one or more GRC, integrated risk-management, third-party risk, privacy, vulnerability-management, audit, or security platforms, such as ServiceNow IRM/GRC, OneTrust, LogicGate, Tenable, Qualys, Rapid7, or comparable technologies.
• Experience integrating cybersecurity and technology risks into broader enterprise risk-management processes, including risk assessments, control evaluations, risk registers, remediation plans, and executive reporting.
• Knowledge of higher education regulatory requirements, including FERPA, GLBA, the FTC Safeguards Rule, and related privacy, security, and compliance requirements applicable to distance education institutions.
• Ability to analyze complex technical and regulatory issues, identify practical solutions, and clearly communicate risks and recommendations to technical teams, business leaders, and executive stakeholders.
• Experience serving as a strategic business partner and influencing stakeholders to implement appropriate security, risk-management, and compliance practices.
• Demonstrated continuous-improvement mindset, with experience enhancing processes, controls, workflows, reporting, automation, and program maturity.
• Ability and willingness to work hands-on with team members and cross-functional stakeholders to deliver assessments, projects, remediation activities, and information security initiatives.
• Ability to professionally communicate fluently in verbal and written English.
• Ability to support a diverse and inclusive work environment.
• Computer literacy/basic computer skills to effectively navigate and utilize the technology required for the role.

Requirements

• Advanced degree or equivalent professional experience and advanced proficiency in one or more of the required skills or disciplines.
• One or more current professional certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified in Governance, Risk and Compliance, Certified Information Systems Auditor, or a comparable information security or risk-management certification.
• Experience supporting information security and GRC programs within higher education, distance education, financial services, healthcare, nonprofit, multi-entity, shared-services, or another highly regulated environment.
• Experience with the Gramm-Leach-Bliley Act Safeguards Rule, FERPA, HIPAA, state privacy requirements, breach-notification laws, and related information security obligations.
• Experience supporting security governance, risk, compliance, or technology integration activities associated with acquisitions, organizational restructuring, new business entities, or external partnerships.
• Proficient in MS Office (Word, Excel, PowerPoint) and other business tools such as Microsoft Teams.

Benefits

• Medical (including prescription), Dental, Vision (UMA subsidized)
• FSA/HSA (Depending on Medical Plan chosen)
• Basic Life Insurance (UMA paid) minimum $50,000 - maximum $250,000 (1x annual salary)
• Additional Voluntary Life Insurance (Team Member paid)
• Employee Assistance Program – EAP (UMA paid)
• Long Term Disability (UMA paid)
• Short Term Disability (Team Member paid)
• Supplemental Insurance such as Critical Illness, Accident, and Hospital (Team Member Paid)
• Paid Time Off – 15 days accrued in year 1, 9 holidays, and 1 day of Volunteering Time Off
• 401k (eligible upon completion of 90 days of employment and must be at least 18 years of age)
• Pet Insurance
• Identity Theft Protection

Work Environment/Physical Demands

• This is a full-time remote position, with occasional onsite travel required.
• Home office set up, quiet place to work, ability to be on camera, and ability to hard wire into high-speed internet connection.
• May require setup of computer equipment; accommodation consideration available upon request.
• Flexibility to work evenings and weekends, as needed.

Compensation Range

$150,000 — $159,390 USD

OUR CORE VALUES

• COLLABORATE: We achieve more together.
• ADVOCATE: We boldly champion those we serve.
• RESPECT: We honor ourselves and each other.
• EMPOWER: We unlock potential.