Lead Information Security Auditor (GRC)

Key Responsibilities

Cybersecurity Governance

• Lead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.
• Establish governance processes that align cybersecurity initiatives with business objectives and regulatory requirements.
• Maintain cybersecurity framework alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.
• Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.
• Facilitate cybersecurity steering committees and governance forums with senior stakeholders.
• Track remediation activities and ensure accountability for risk mitigation activities.

Enterprise Risk Management

• Lead enterprise-wide cybersecurity risk assessment and risk management programs.
• Establish and maintain a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
• Evaluate risks related to patient safety, operational resilience, intellectual property protection, regulatory exposure, and business continuity.
• Perform risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.
• Develop risk treatment plans and monitor mitigation efforts through completion.
• Translate technical security risks into business impact statements for executive leadership.

Regulatory Compliance & Audit Management

• Lead cybersecurity compliance efforts supporting SOX, ISO 27001, NIST, GDPR, NIS2, and applicable healthcare and manufacturing requirements.
• Coordinate internal audits, external audits, regulatory inspections, and customer security assessments.
• Manage evidence collection, control validation, and remediation tracking activities.
• Conduct control maturity assessments and gap analyses against regulatory and industry frameworks.
• Partner with Internal Audit, Legal, Compliance, and Regulatory Affairs to ensure ongoing compliance readiness.
• Oversee audit findings and corrective action plans through closure.

Third-Party Risk Management

• Lead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers.
• Establish third-party security requirements and contractual security obligations.
• Evaluate supplier security posture and monitor compliance with organizational requirements.
• Assess third-party risks impacting manufacturing operations, product development, cloud services, and intellectual property.
• Drive remediation and risk acceptance processes for identified supplier risks.

Product Security Governance

• Partner with Engineering, Product Development, Quality, and Regulatory Affairs teams to ensure cybersecurity requirements are incorporated throughout the product lifecycle.
• Oversee cybersecurity risk assessments for medical and surgical devices.
• Support secure development governance processes and cybersecurity documentation requirements.
• Ensure compliance with applicable device cybersecurity guidance and regulatory expectations.
• Facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.

Security Awareness & Compliance Culture

• Lead enterprise cybersecurity awareness, education, and compliance initiatives.
• Promote a culture of security accountability and risk ownership throughout the organization.
• Develop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams.
• Support phishing awareness, policy compliance, and security training programs.
• Measure and report on program effectiveness and compliance trends.

Business Continuity & Resilience Governance

• Partner with business continuity and disaster recovery stakeholders to ensure cyber resilience requirements are addressed.
• Support business impact analyses and resilience planning activities.
• Participate in tabletop exercises and cyber crisis management planning.
• Evaluate recovery capabilities and resilience controls for critical business processes and manufacturing operations.
• Monitor remediation actions resulting from exercises and resilience assessments.

Leadership & Stakeholder Management

• Provide leadership and direction for cybersecurity governance, risk, and compliance initiatives.
• Mentor cybersecurity professionals on risk management, compliance frameworks, and governance best practices.
• Serve as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs functions.
• Present risk and compliance updates to executive leadership, committees, and external stakeholders.
• Support strategic cybersecurity planning and roadmap development.

Job Requirements

• Bachelor's degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or related field (or equivalent experience).
• 7+ years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.

Preferred Experience

• Experience developing and managing cybersecurity governance, risk, and compliance programs.
• Experience conducting risk assessments and managing enterprise risk registers.
• Experience supporting internal audits, external audits, and regulatory examinations.
• Strong understanding of cybersecurity frameworks and regulatory requirements.
• Experience in healthcare, medical device manufacturing, life sciences, or regulated industries.
• Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.
• Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.
• Experience developing executive risk reporting, metrics, and board-level presentations.
• Familiarity with medical device cybersecurity regulations and product security risk management.
• Professional certifications preferred: CISSP, CRISC, CISM, CGRC (formerly CAP), CISA (Preferred), ISO 27001 Lead Implementer or Lead Auditor.

This position is not eligible for employer-visa sponsorship.