Cybersecurity Governance, Risk, Compliance, Training & Resilience Manager

Wind River Systems

Wind River is an Equal Opportunity Employer with a commitment to diversity. We prohibit discrimination based on race, color, religion, gender, national origin, age, disability, veteran status, marital status, pregnancy, gender expression or identity, sexual orientation or any other legally protected status.

IT & Security
• Cupertino, California

Wind River is a global leader in delivering software for mission‑critical intelligent systems. For more than four decades, the company has been an innovator and pioneer, powering billions of systems that require the highest levels of security, safety, and reliability. We help customers across automotive, aerospace, defense, industrial, medical, and telecommunications industries solve complex technology challenges on their journey toward the new intelligent machine economy.

The company's software powers generation after generation of the safest, most secure systems in the world. Examples include playing a key role in NASA space missions such as Artemis I, the James Webb Space Telescope, and multiple Mars rovers. We've achieved recent 5G milestones including the world’s first successful 5G data session with Verizon and building one of the largest Open RAN networks in the world with Vodafone.

The company has received industry recognition for its technology innovation and leadership, and for its workplace culture, including global Great Place to Work certification and being named a “Top Workplace” for ten consecutive years. If you want to be part of a unique culture where experience is based on our cultural attributes of growth mindset, customer‑focus, and diversity, equity, inclusion & belonging, come join us and help advance the future software‑defined world.

We are hiring a Manager to lead the day‑to‑day execution of cybersecurity Governance, Risk & Compliance (GRC) and enterprise resilience programs across both Wind River and Aptiv. This dual‑entity role will serve as a key operational leader, ensuring regulatory compliance, audit readiness, risk tracking, and documentation integrity across multiple frameworks including ISO 27001, NIST 800-171, SOX, GDPR, Fed Ramp, CMMC and TISAX.

While the Director maintains strategic ownership of all four functional areas (GRC, TPRM, Training, and Resilience), this role will provide hands‑on coverage for Wind River’s TPRM and Training efforts, working closely with the Aptiv TPRM & Training Manager to ensure continuity and alignment. In addition, this role will own GRC work streams supporting One Aptiv integration, directly supporting Aptiv, Wind River, and other One Aptiv companies as needed, including TSA execution and M&A onboarding.

This position is critical to stabilizing day‑to‑day operations and enabling long‑term scalability across the enterprise.

• Lead execution of GRC programs across Aptiv and Wind River, including control maintenance, risk register updates, and audit readiness.
• Maintain documentation, controls, and audit‑ready evidence for ISO 27001, NIST 800-171, TISAX, SOX, NIS2, CMMC, and GDPR across both Aptiv and Wind River, incorporating new regulatory or customer requirements as they arise.
• Administer GRC tooling (ZenGRC, Audit Board, Service Now), ensuring accuracy, auditability, and workflow continuity.
• Manage internal risk exceptions, maturity roadmaps, and control owners’ engagement.
• Provide daily operational support to maintain compliance posture and support regulatory assessments.
• Own documentation and execution for business impact assessments, continuity planning, and tabletop exercises.
• Coordinate resilience planning with cross‑functional partners including IT, Facilities, Cyber Defense, and Legal.
• Maintain continuity playbooks, incident response records, and recovery planning materials.
• Provide execution support for Wind River’s third‑party risk assessments, evidence collection, and remediation tracking.
• Execute and drive enforcement of cybersecurity right‑to‑audit clauses with vendors and partners.
• Review and provide redlines on cybersecurity and compliance sections of both buy‑side and sell‑side contracts.
• Collaborate with the…