Cyber GRC Manager

Client of Stellar Hunters

Key Responsibilities

• Develop and evolve a risk-based cyber GRC strategy that aligns with enterprise risk appetite and business priorities.

• Lead the GRC program, including governance forums, risk assessment cadence, control frameworks, and remediation tracking.

• Partner with senior leadership to translate regulatory and business requirements into practical program objectives and roadmaps.

Policy, Standards & Control Management

• Maintain and enhance information security policies, standards, and procedures; ensure clear ownership and version control across the policy lifecycle.

• Define and maintain control objectives mapped to frameworks (e.g., NIST CSF, ISO 27001, SOC 2) and ensure consistent implementation across teams.

• Coordinate control testing, assessments, and remediation activities with internal teams and external assessors.

Risk Assessment & Third-Party Risk Management

• Conduct enterprise and technology risk assessments; identify, evaluate, and prioritize cyber risks and mitigation plans.

• Own third-party risk management processes including vendor risk assessments, due diligence, contract security requirements, and ongoing monitoring.

• Work with procurement and vendor owners to remediate deficiencies and reduce supply chain risk.

Compliance & Audit Support

• Manage compliance programs and readiness for relevant regulations and standards (e.g., SOC 2, ISO 27001, GDPR, HIPAA where applicable).

• Act as primary liaison for internal and external audits, prepare evidence and reporting, and coordinate remediation activities.

• Maintain documentation and continuous evidence of controls to support attestations and regulatory reporting.

Metrics, Reporting & Continuous Improvement

• Define and report GRC metrics and dashboards (e.g., risk posture, control maturity, remediation timelines, vendor risk status) to leadership and stakeholders.

• Use data and trend analysis to identify program gaps, recommend improvements, and measure the effectiveness of risk reduction efforts.

• Develop and maintain GRC playbooks, runbooks, and process documentation to enable repeatable, auditable practices.