Senior Director, Information Security Manager (Cyber GRC Frameworks/Policies/Controls)

• We’re seeking a future team member for the role of Senior Director, Information Security (Cyber GRC Frameworks, Policies, and Controls) to join our CyberSecurity team. This role is located in New York.
• In this role, you’ll make an impact in the following ways:
• Lead development, maintenance, and modernization of cyber governance frameworks, policies, standards, and control principles.
• Define and maintain a common cyber control taxonomy and control framework aligned to enterprise risk, regulatory obligations, and technology domains.
• Rationalize control inventories to reduce duplication, remove ambiguity, and improve consistency across Platforms and shared services.
• Map controls to risks, policy requirements, standards, obligations, important services, and accountable owners.
• Establish and govern exception processes for cyber standards and control requirements, including review, challenge, documentation, and escalation.
• Partner with control owners and technology stakeholders to embed policy and control requirements earlier in the change, engineering, and delivery lifecycle.
• Support control framework alignment across key domains such as identity, infrastructure, application security, third-party risk, and resilience.
• Define control objectives, minimum requirements, and design expectations to support consistent assessment and testing outcomes.
• Collaborate with governance and reporting teams to improve management transparency and control health reporting.
• Drive policy refresh cycles based on threat change, regulatory developments, audit feedback, and strategic transformation priorities.
• Contribute to integration of AI and emerging technology governance requirements into the broader cyber control architecture.
• Support target-state enablement through improved workflow, data quality, and automated evidence opportunities.
• To be successful in this role, we’re seeking the following:
• Bachelor’s degree or equivalent experience in Cybersecurity, Information Security, Risk Management, Technology, or a related discipline.
• Significant experience in Cyber GRC, technology risk, control framework management, cyber policy, or related governance functions.
• Strong understanding of cybersecurity control domains, including identity, infrastructure, application security, vulnerability management, resilience, and third-party risk.
• Experience designing or managing policy hierarchies, standards frameworks, and control inventories in a complex enterprise environment.
• Knowledge of risk and control mapping, control rationalization, and governance processes.
• Ability to translate regulatory, audit, and operational requirements into practical control requirements.
• Strong written communication and stakeholder management skills.

None flagged.