Governance, Risk and Compliance Leader (USI9) (3229)

SUMMARY:

The Governance, Risk and Compliance (GRC) Leader is a subject matter lead for cybersecurity governance, risk and compliance and runs the GRC program day to day, reporting to the CISO, who retains decision authority and accountability for the program. This role architects and builds the program on the NIST Cybersecurity Framework (CSF) 2.0: documenting the company's current profile, defining a target profile with business stakeholders, and delivering a prioritized roadmap of projects to close each gap. The core outcome of the program is fast, accurate and defensible responses to customer, partner, and prospect security questionnaires. The role also maintains the policy library and risk register, leads audits and control testing, manages security terms in third-party contracts in partnership with Legal, and supports CMMC and NIST SP 800-171 compliance for VSE's defense customers. The role operates with a high degree of autonomy, influences leaders across the business without direct authority, and is expected to build and lead the GRC team as the function grows.

DUTIES & RESPONSIBILITIES:

Responsibilities include, but are not limited to:

• Run the cybersecurity GRC program end to end, executing the program direction set by the CISO and recommending priorities, resourcing, and operating rhythm.
• Build and maintain VSE's NIST CSF 2.0 current profile by interviewing control owners across IT, Security, Legal, HR, Finance, Operations and the business units, and validating posture with evidence.
• Develop the target profile for CISO approval, working with business leaders, aligned to business risk, customer obligations, and regulatory requirements.
• Recommend and maintain a prioritized roadmap of projects, approved by the CISO, that closes the gaps between current and target profiles, track execution, and report progress.
• Maintain a unified control framework mapped across NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-171 and other applicable frameworks, and use these crosswalks to demonstrate compliance to customers, partners and regulators (for example EASA Part-IS) and to answer questionnaires from a single control set.
• Lead responses to inbound security questionnaires and due diligence requests from customers, partners, and prospects (for example SIG, CAIQ and defense customer requirements), escalating new or non-standard attestations to the CISO for sign-off.
• Own the security AnswerBank and Trust Center content so responses are accurate, consistent, and timely.
• Maintain the enterprise cybersecurity risk register, including risk identification, scoring, treatment plans, and owners. Administer the risk acceptance workflow; acceptance decisions rest with risk owners and the CISO.
• Maintain the information security policy and standards library; coordinate annual review, approval, and communication.
• Run the policy exception process, including documentation, compensating controls, expiration and periodic review, routing exceptions for approval under defined authority levels.
• Support governance of AI use across VSE, including AI tool risk reviews, an inventory of approved AI tools, and alignment with emerging AI risk frameworks such as the NIST AI Risk Management Framework.
• Maintain the compliance calendar, coordinate control testing and evidence collection, and track findings to closure.
• Automate evidence collection and continuous control monitoring, where practical, to reduce manual compliance effort and improve accuracy.
• Serve as primary liaison for internal audit, external auditors, customer audits, and third-party assessors, including SOX IT general controls and CMMC assessments.
• Track compliance exercises and recommend improvements to the GRC program based on results, lessons learned and changes in requirements.
• Define, track and report GRC metrics to the CISO, including NIST CSF maturity against the target profile, roadmap milestone progress, questionnaire turnaround time and AnswerBank reuse, and key risk indicators such as high risks outside appetite and expired policy exceptions or risk acceptances.
• Build and maintain a security contract clause playbook with Legal, defining preferred, fallback, and unacceptable positions for CISO approval.
• Review vendor, partner, and customer contracts against the playbook, identify where changes are needed, and work with Legal and the CISO on redlines. Escalate any deviation from approved positions to the CISO.
• Issue security questionnaires to vendors and evaluate responses in coordination with the third-party risk management process.
• Evaluate, recommend, and implement a GRC platform to replace manual tracking.
• Assess the security and compliance posture of acquired companies and plan their alignment to VSE's control framework.
• Mentor control owners and junior staff and lay the groundwork to build and lead a GRC team.
• Serve as VSE's subject matter expert on defense-sector cybersecurity obligations from prime contractors and regulators, including DFARS 252.204-7012, 7019, 7020 and 7021 flow-downs, and advise leaders on their impact.
• Lead CMMC and NIST SP 800-171 compliance workstreams across VSE business units, including System Security Plans (SSP), Plans of Action and Milestones (POA&M), evidence packages and SPRS score calculation. Prepare affirmation packages for review and signature by VSE's designated Affirming Official.
• Other duties as assigned.

MINIMUM REQUIREMENTS:

• Bachelor's degree in information security, information technology, computer science, or related field.

• or an additional 3 years of specific work experience in lieu of degree.

• 7 years of experience in information security, IT risk, or IT audit, including 3+ years building or leading a GRC program.

• Demonstrated experience building a security program on NIST CSF or ISO/IEC 27001, including current state assessment, target state definition, a prioritized remediation roadmap, and cross-framework control mapping.

• Track record of leading cross-functional programs and influencing senior stakeholders without direct authority.

• Experience owning a risk register, a policy library, and a policy exception process.

• Experience reviewing security and data protection terms in contracts and working with legal counsel.

• Experience completing security questionnaires (SIG, CAIQ or similar) and maintaining a response library.

• Ability to interview non-technical stakeholders, translate business processes into control language, and present findings and recommendations to senior leaders.

• Must be a U.S. Person as defined in 22 CFR 120.62 (for example, a U.S. citizen or lawful permanent resident).

PREFERRED REQUIREMENTS:

• One or more of: CISSP, CISA, CRISC, CISM, CGEIT, ISO/IEC 27001 Lead Implementer or Lead Auditor, or CMMC CCP/CCA.
• Experience in aerospace, aviation, defense, or government contracting environments.
• Experience implementing an enterprise GRC platform (for example ServiceNow IRM, AuditBoard, Archer, LogicGate or OneTrust) and automating compliance evidence or reporting.
• Experience with AI governance or AI risk management (for example NIST AI RMF or ISO/IEC 42001).
• Experience supporting SOX IT general controls testing.
• Experience in a multi-site or acquisitive company.
• Experience with NIST SP 800-171 and CMMC 2.0, including System Security Plans, POA&Ms and supporting a CMMC Level 2 assessment.

OTHER:

• U.S. Person status (22 CFR 120.62) required due to access to export-controlled (ITAR/EAR) information and Controlled Unclassified Information (CUI). No security clearance required.
• Hybrid schedule based at one of VSE's offices: Bloomfield, CT; Miami, FL; Miramar, FL; Davie, FL; or Bedford, NH.
• Occasional travel to VSE sites for assessments and audits.
• The selected applicant will be subject to a background check and drug testing.