Information Security Governance, Risk and Compliance; GRC) Lead

It’s more than what you do: it’s how you do it. That’s why O’Melveny is counsel of choice to an ever-expanding list of market leaders. Opportunity at O’Melveny means working alongside dynamic and team-oriented colleagues on evolving legal and business issues and opportunities for prominent clients around the world. It’s a place to build a rewarding career by tackling new challenges;

being appreciated, included, and supported; and creating lasting connections.

With approximately 850 lawyers on three continents, more than 80 practice and industry service areas, and strong cultural ties to its 17 locations, O’Melveny is a global law firm with a local feel. At our core, you’ll find a dedication to excellence, a drive to lead and innovate, and a deep sense of civic responsibility.

So, tell us. What do you want to achieve? Visit us at ; learn more in our firm at-a-glance; and find us on Linked In, Facebook, Instagram, and You Tube.

O’Melveny has an immediate opening for an Information Security Governance, Risk and Compliance (GRC) Lead. This position can be remote or based out of any of our U.S. offices (Austin, Century City, Dallas, Houston, Los Angeles, New York City, Newport Beach, San Francisco, Silicon Valley, Washington DC). This application is for the Austin office.

The Information Security Governance, Risk and Compliance (GRC) Lead serves as the subject matter expert for firmwide Information Security GRC initiatives, collaborating closely with the Information Security Officer. This role encompasses the development, implementation and ongoing coordination of GRC efforts. The GRC Lead is responsible for tracking information security risks, conducting risk analyses and mitigation options, coordinating information security metrics, while regularly tracking and reporting to Information Security leadership.

In addition, the Lead accepts duties to enforce GRC rigor globally for firmwide information security obligations. Additionally, this role involves implementing and advancing policies and a comprehensive control framework to execute the GRC strategy. The GRC Lead oversees the administration of standards and controls, risk management, third-party risk (TPRM), baseline security controls and technology compliance initiatives. The GRC Lead coordinates information security audits and assessments, including tracking, timely responses, and interactions with O’Melveny clients and external auditors.

The GRC Lead will also assist with reviewing outside counsel guidelines. This position will also develop a third-party risk management program, and assist with reviewing third-party risk, utilizing tools as well as reviewing due diligence documentation, such as questionnaires and SOC reports.

This position requires a deep understanding of ISO/IEC 27001, risk management methodologies, technical controls, and a proactive approach to addressing both operational and strategic risks. The GRC Lead collaborates with a cross‑functional team of information security and information technology analysts to evaluate controls, map them to key performance indicators, measure effectiveness and produce timely reports for management. These reports are essential for identifying, evaluating and reporting on cybersecurity risks that may impact the business, ensuring informed decision‑making.

Strong business acumen and a diverse technical background are crucial for understanding emerging technologies and legacy systems considered business critical. The GRC Lead reports to the Information Security Officer.

Remote applications will be accepted from candidates who reside in the following states: AL, AZ, CA, CO, D.C., FL, HI, , IL, LA, MD, MA, MN, MO, NC, NH, NV, NJ, NY, OH, OR, PA, SC, TX, UT, VA, WA, WV.