{"id":3101018,"url":"https://alion.io/job/conmed-lead-information-security-auditor-grc","title":"Lead Information Security Auditor (GRC)","company":{"id":1896673,"name":"CONMED","domain":"conmed.com","url":"https://alion.io/company/conmed-com","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Schema","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"inferred_payroll_markers","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":104134,"max":163640,"currency":"USD","period":"year","gross":null,"usd_annual":163640},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST 800-53","optional":false},{"name":"NIST CSF","optional":false},{"name":"ServiceNow","optional":true}],"status":"live","first_seen_at":"2026-10-22T16:37:46Z","employer_posted_date":null,"last_verified_at":"2026-10-22T16:37:46Z","board_verified":false,"closed_at":null,"days_open":3,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":3},"description":"The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization's cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology (OT), and enterprise IT environments.\n\nThis role ensures the organization effectively manages cyber risk, complies with applicable regulatory and industry requirements, and maintains governance processes that protect intellectual property, patient safety, operational resilience, and business objectives. The position serves as a key liaison between cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators to ensure security requirements are embedded throughout the organization's operations and product lifecycle.\nThis role plays a critical part in enabling secure innovation, supporting regulatory readiness, managing enterprise cyber risk, and providing executive visibility into cybersecurity posture and compliance performance.\n\nKey Responsibilities:\nCybersecurity Governance\nLead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.\n\nEstablish governance processes that align cybersecurity initiatives with business objectives and regulatory requirements.\n\nMaintain cybersecurity framework alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.\n\nDevelop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.\n\nFacilitate cybersecurity steering committees and governance forums with senior stakeholders.\n\nTrack remediation activities and ensure accountability for risk mitigation activities.\n\nEnterprise Risk Management\nLead enterprise-wide cybersecurity risk assessment and risk management programs.\n\nEstablish and maintain a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.\n\nEvaluate risks related to patient safety, operational resilience, intellectual property protection, regulatory exposure, and business continuity.\n\nPerform risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.\n\nDevelop risk treatment plans and monitor mitigation efforts through completion.\n\nTranslate technical security risks into business impact statements for executive leadership.\n\nRegulatory Compliance & Audit Management\nLead cybersecurity compliance efforts supporting SOX, ISO 27001, NIST, GDPR, NIS2, and applicable healthcare and manufacturing requirements.\n\nCoordinate internal audits, external audits, regulatory inspections, and customer security assessments.\n\nManage evidence collection, control validation, and remediation tracking activities.\n\nConduct control maturity assessments and gap analyses against regulatory and industry frameworks.\n\nPartner with Internal Audit, Legal, Compliance, and Regulatory Affairs to ensure ongoing compliance readiness.\n\nOversee audit findings and corrective action plans through closure.\n\nThird-Party Risk Management\nLead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers.\n\nEstablish third-party security requirements and contractual security obligations.\n\nEvaluate supplier security posture and monitor compliance with organizational requirements.\n\nAssess third-party risks impacting manufacturing operations, product development, cloud services, and intellectual property.\n\nDrive remediation and risk acceptance processes for identified supplier risks.\n\nProduct Security Governance\nPartner with Engineering, Product Development, Quality, and Regulatory Affairs teams to ensure cybersecurity requirements are incorporated throughout the product lifecycle.\n\nOversee cybersecurity risk assessments for medical and surgical devices.\n\nSupport secure development governance processes and cybersecurity documentation requirements.\n\nEnsure compliance with applicable device cybersecurity guidance and regulatory expectations.\n\nFacilitate coordinated vulnerability disclosure governance and vulnerability management oversight.\n\nSecurity Awareness & Compliance Culture\nLead enterprise cybersecurity awareness, education, and compliance initiatives.\n\nPromote a culture of security accountability and risk ownership throughout the organization.\n\nDevelop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams.\n\nSupport phishing awareness, policy compliance, and security training programs.\n\nMeasure and report on program effectiveness and compliance trends.\n\nBusiness Continuity & Resilience Governance\nPartner with business continuity and disaster recovery stakeholders to ensure cyber resilience requirements are addressed.\n\nSupport business impact analyses and resilience planning activities.\n\nParticipate in tabletop exercises and cyber crisis management planning.\n\nEvaluate recovery capabilities and resilience controls for critical business processes and manufacturing operations.\n\nMonitor remediation actions resulting from exercises and resilience assessments.\n\nLeadership & Stakeholder Management\nProvide leadership and direction for cybersecurity governance, risk, and compliance initiatives.\n\nMentor cybersecurity professionals on risk management, compliance frameworks, and governance best practices.\n\nServe as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs functions.\n\nPresent risk and compliance updates to executive leadership, committees, and external stakeholders.\n\nSupport strategic cybersecurity planning and roadmap development.\n\nJob Requirements\nBachelor's degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or related field (or equivalent experience).\n\n7+ years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.\n\nPreferred Experience\nExperience developing and managing cybersecurity governance, risk, and compliance programs.\n\nExperience conducting risk assessments and managing enterprise risk registers.\n\nExperience supporting internal audits, external audits, and regulatory examinations.\n\nStrong understanding of cybersecurity frameworks and regulatory requirements.\n\nExperience in healthcare, medical device manufacturing, life sciences, or regulated industries.\n\nDeep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.\n\nExperience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.\n\nExperience developing executive risk reporting, metrics, and board-level presentations.\n\nFamiliarity with medical device cybersecurity regulations and product security risk management.\n\nProfessional certifications preferred:\nCISSP\n\nCRISC\n\nCISM\n\nCGRC (formerly CAP)\n\nCISA (Preferred)\n\nISO 27001 Lead Implementer or Lead Auditor\n\nThis position is not eligible for employer-visa sponsorship\n\nDisclosure as required by applicable law, the annual salary range for this position is $104,134 - $163,640. The actual compensation may vary based on geographic location, work experience, education and skill level. The salary range is CONMED’s good faith belief at the time of this posting. \n\nThis job posting is anticipated to close on November 8, 2026. We may, however, extend this time period, in which case the posting will remain available on careers.conmed.com. Please submit your application as soon as possible as we will be reviewing applications on a rolling basis as we receive them.\nBenefits:\nCONMED offers a wide array of benefits to fit your unique needs. Visit our Benefits Page for more information.\n\nCompetitive compensation\n\nExcellent healthcare including medical, dental, vision and prescription coverage\n\nShort & long term disability plus life insurance -- cost paid fully by CONMED\n\nRetirement Savings Plan (401K) -- CONMED matches your contributions dollar for dollar, with the potential for up to 7% per pay period\n\nEmployee Stock Purchase Plan -- allows stock purchases at discounted price\n\nTuition assistance for undergraduate and graduate level courses\n\nKnow someone at CONMED? Have them submit you as a referral before applying for this position to be eligible for our Employee Referral Program incentives!\nCONMED is an equal opportunity employer and does not discriminate on the basis of any legally protected status or characteristic. Protected veterans and individuals with disabilities are encouraged to apply. The Know Your Rights: Workplace Discrimination is Illegal Poster reaffirms this commitment.\nColorado Residents: In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.\nIf you feel you need a reasonable accommodation pursuant to the ADA, you are encouraged to contact us at 800-929-7176 option #5.\nOriginally posted on Himalayas","description_format":"text","description_chars":9165,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Life insurance","Retirement plans"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Penetration Testing","Information Security","Surgical Instruments & Devices","Orthopedic & Spine Implants"],"lifecycle":[{"event":"open","at":"2026-10-22T17:28:15Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2 · green card filings: 1","filings_12m":2,"filings_prev_12m":2,"green_card_filings_12m":1,"median_offered_wage_usd":99167,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":27,"reasons":["seen:2","velocity","win:early"],"computed_at":"2026-10-25T05:49:26Z"},"pay":{"stated_usd_annual":163640,"is_top_pay":false},"html_url":"https://alion.io/job/conmed-lead-information-security-auditor-grc","json_url":"https://alion.io/job/conmed-lead-information-security-auditor-grc.json","meta":{"generated_at":"2026-10-26T02:39:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3469,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1896673},"rest":"https://alion.io/mcp/rest/get_company?id=1896673"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fconmed-lead-information-security-auditor-grc"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fconmed-lead-information-security-auditor-grc"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fconmed-lead-information-security-auditor-grc"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/conmed-lead-information-security-auditor-grc\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fconmed-lead-information-security-auditor-grc"}]}