Director of Governance, Risk and Compliance

Home Careers Jobs Director of Governance, Risk and Compliance

Director of Governance, Risk and Compliance

Governance, Risk and Compliance | Long Beach, United States

Description

Laserfiche is hiring a Director of Governance, Risk & Compliance (GRC) to lead enterprise-wide governance, risk and compliance programs s hands-on role will be responsible for ensuring the organization operates in alignment with regulatory compliance requirements, industry standards and internal policies, while enabling business agility and operational excellence. The ideal candidate has deep experience in cyber and physical security, IT risk management, business resiliency, AWS services and data privacy-along with hands-on involvement with implementing controls, standards and frameworks such as ISO 27001, NIST 800-53, FedRAMP/GovRAMP and SOC 2 controls (AICPA Trust Services Criteria).

Location:

* Hybrid:
Three days per week (Tuesday, Wednesday and Thursday) in-office in Long Beach, CA

* Remote work from home on Mondays and Fridays

About the Role
- Key Responsibilities:

Governance and Risk Management

* Develop and lead the enterprise Governance, Risk and Compliance (GRC) program to ensure effective alignment between business objectives, risk management and regulatory compliance requirements.

* Provide hands-on leadership for AI and security governance, cybersecurity controls (SOC 2, ISO 27001, GovRAMP/FedRAMP, CMMC, NIST 800-53, CJIS, PCI), data privacy and regulatory compliance (EU AI Act, GDPR, CCPA, PIPEDA, HIPAA).

* Partner with technology and business leaders to assess AI, technology and security risks, and ensure appropriate controls are designed, implemented, tested and operating effectively.

* Collaborate with ITS, Development and other departments to lead IT, security and business resiliency policy creation, maintenance, communication, training and enforcement across the enterprise.

* Safeguard Laserfiche information in accordance with Laserfiche Information Security Policies.

Compliance & Controls Oversight and Monitoring

* Own and lead compliance and certification programs (SOC 2, ISO 27001, ISO 42001, ISO 9001, GovRAMP/FedRAMP, CCMC) that are aligned to industry standards and regulatory frameworks.

* Manage and conduct internal audits, risk assessments, third-party and vendor risk management assessments.

* Coordinate control self-assessments, remediation and risk treatment plans.

* Manage and update control matrices and risk registers; ensure controls are mapped to relevant frameworks and operating effectively.

* Manage continuous controls monitoring and risk reporting provided to external and internal stakeholders.

Data Privacy

* Partner with Legal, ITS, Development, People and other organizations to operationalize privacy requirements.

* Oversee and perform data mapping and data inventory activities, ensuring accurate organizational understanding of data flows, risks and controls.

* Collaborate with Legal and other departments on performing DPIA/PIAs and other compliance initiatives.

Business Resiliency and Disaster Recovery (DR)

* Lead the business continuity management program, including performing an annual business impact analysis (BIA), developing, testing and updating BCPs, and providing organizational training in collaboration with L&D.

* Coordinate with ITS on DR planning and testing, and working with executive stakeholders on updating and testing crisis management plans (CMP).

Customer Sales Enablement and Product Development

* Collaborate with Sales, ITS, Development and Legal on sales enablement initiatives including responding to RFPs and customer questionnaires on security controls, data privacy, AI, BCM, DR and CMP.

* Serve as a subject matter expert on internal controls and security, and collaborate with Product Strategy, Development and ITS on product enhancements, features and security capabilities.

* Monitor Laserfiche security controls and compliance with customer contractual requirements.

About You - Essential

Qualifications:

* Bachelor's degree in management information systems, IT audit, cybersecurity or related degree program is required

* Minimum of 7+ years of experience in information security, IT risk…