Experience: 8 to 12 years in IT governance, risk, and compliance, including leading GRC programs or major initiatives in enterprise environmentsHands-on experience operating and maturing risk registers, running risk assessments, gap analyses, and business impact analyses, and driving treatment decisions to closureIndependent control testing experience supporting SOX ITGCExperience planning and executing internal auditsExperience owning a third-party risk program, including review of vendor security attestationsExperience running continuous-compliance and evidence collection in a GRC platform. We use VantaExpertise authoring IT and security policies that meet regulatory requirements, and running them through review, ratification, and acknowledgmentTrack record producing board or audit-committee-level reporting on maturity, risk posture, and remediation, and designing metrics tied to risk appetiteExperience building training and awareness programsDeep working knowledge of NIST CSF 2.0 and 800-53; familiarity with SOC 2, ISO 27001, COBIT, and CIS ControlsAbility to explain complex risk to non-technical senior stakeholders and influence decisionsBachelor's degree in a related field, or equivalent experience.