Information Security GRC Manager
First seen by Alion on Oct 30, 2026. Rakuten Rewards scores B on the Alion truth index.
Department : Security Governance and Management Department.
Job Overview :
We are seeking a strategic and experienced Information Security GRC (Governance, Risk & Compliance) Manager to lead and mature our enterprise-wide GRC program across information security, data privacy, and telecommunications regulatory compliance.
This role owns the design, execution, and continuous improvement of the GRC function - managing a team of specialists, driving risk-informed decision-making, and serving as a trusted advisor to senior leadership and the CISO.
Responsibilities :
GRC Program Leadership :
- Own and drive the organization's GRC strategy, roadmap, and operating model.
- Build, lead, and mentor a team of GRC specialists.
- Report program health, risk posture, and compliance status to the CISO and senior leadership.
- Define and track GRC program KPIs and OKRs.
Policy & Standards Governance :
- Oversee the lifecycle management of the organization's information security, privacy, and telecom compliance policy framework.
- Ensure policies are aligned with regulatory requirements and industry frameworks (e.g., ISO 27001, NIST CSF).
Risk Management :
- Lead the enterprise information security risk management program.
- Provide risk-based guidance to business and technology stakeholders.
- Develop and maintain risk appetite and tolerance statements.
- Oversee third-party and vendor risk management processes.
Compliance & Audit Management :
- Manage compliance posture across ISO 27001, GDPR, and telecom-specific regulations.
- Direct and coordinate internal and external audit activities.
- Oversee remediation tracking for audit findings.
Qualifications :
- Bachelor's or Master's degree in Information Security, Computer Science, Law, Business Administration, or related field.
- 7-10 years of progressive experience in information security or GRC.
- 3-5 years in a people management or team leadership role.
- Expertise in ISO 27001, GDPR, and NIST CSF.
- Telecom domain knowledge is highly desirable.
Certifications (preferred) :
- CISM, CISSP, CISA, CIPP, or ISO 27001 Lead Implementer/Auditor.
Skills
Information Security, IT Governance, IT Risk, IT Compliance, CISSP, CISM, CISA, GRC Tools, Security