Governance, Risk and Compliance Leader; USI

SUMMARY:

The Governance, Risk and Compliance (GRC) Leader is a subject matter lead for cybersecurity governance, risk and compliance and runs the GRC program day to day, reporting to the CISO, who retains decision authority and accountability for the program. This role architects and builds the program on the NIST Cybersecurity Framework (CSF) 2.0: documenting the company's current profile, defining a target profile with business stakeholders, and delivering a prioritized roadmap of projects to close each gap.

The core outcome of the program is fast, accurate and defensible responses to customer, partner, and prospect security questionnaires. The role also maintains the policy library and risk register, leads audits and control testing, manages security terms in third-party contracts in partnership with Legal, and supports CMMC and NIST SP 800-171 compliance for VSE's defense customers. The role operates with a high degree of autonomy, influences leaders across the business without direct authority, and is expected to build and lead the GRC team as the function grows.

DUTIES & RESPONSIBILITIES:

Responsibilities include, but are not limited to:

Run the cybersecurity GRC program end to end, executing the program direction set by the CISO and recommending priorities, resourcing, and operating rhythm.

Build and maintain VSE's NIST CSF 2.0 current profile by interviewing control owners across IT, Security, Legal, HR, Finance, Operations and the business units, and validating posture with evidence.

Develop the target profile for CISO approval, working with business leaders, aligned to business risk, customer obligations, and regulatory requirements.

Recommend and maintain a prioritized roadmap of projects, approved by the CISO, that closes the gaps between current and target profiles, track execution, and report progress.

Maintain a unified control framework mapped across NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-171 and other applicable frameworks, and use these crosswalks to demonstrate compliance to customers, partners and regulators (for example EASA Part-IS) and to answer questionnaires from a single control set.

Lead responses to inbound security questionnaires and due diligence requests from customers, partners, and prospects (for example SIG, CAIQ and defense customer requirements), escalating new or non-standard attestations to the CISO for sign-off.

Own the security Answer Bank and Trust Center content so responses are accurate, consistent, and timely.

Maintain the enterprise cybersecurity risk register, including risk identification, scoring, treatment plans, and owners. Administer the risk acceptance workflow; acceptance decisions rest with risk owners and the CISO.Maintain the information security policy and standards library; coordinate annual review, approval, and communication.

Run the policy exception process, including documentation, compensating controls, expiration and periodic review, routing exceptions for approval under defined authority levels.

Support governance of AI use across VSE, including AI tool risk reviews, an inventory of approved AI tools, and alignment with emerging AI risk frameworks such as the NIST AI Risk Management Framework.

Maintain the compliance calendar, coordinate control testing and evidence collection, and track findings to closure.

Automate evidence collection and continuous control monitoring, where practical, to reduce manual compliance effort and improve accuracy.

Serve as primary liaison for internal audit, external auditors, customer audits, and third-party assessors, including SOX IT general controls and CMMC assessments.

Track compliance exercises and recommend improvements to the GRC program based on results, lessons learned and changes in requirements.

Define, track and report GRC metrics to the CISO, including NIST CSF maturity against the target profile, roadmap milestone progress, questionnaire turnaround time and Answer Bank reuse, and key risk indicators such as high risks outside appetite and expired policy exceptions or risk acceptances.

Build and maintain a security contract clause playbook with Legal, defining preferred, fallback, and unacceptable positions for CISO approval.

Review vendor, partner, and customer contracts against the playbook, identify where changes are needed, and work with Legal and the CISO on redlines. Escalate any deviation from approved positions to the CISO.Issue security questionnaires to vendors and evaluate responses in coordination with the…