Manager, GRC-; Information Security Risk

Manager,Information Security Risk
-Governance, Risk, Compliance – Audit
- Hybrid, Cary, North Carolina

We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.

If you're looking for a dynamic, fulfilling career with flexibility and a world-class employee experience, you'll find it here. We're recognized around the world for our inclusive, meaningful culture and innovative technologies by organizations like Fast Company, Forbes, Newsweek and more.

The Manager, Governance, Risk, Compliance – Audit (GRC-A) is a hands on management role combining technical risk managementexpertisewith people leadership, overseeing a team that evaluates information security andcybersecurity risksacrossSAS and ourthird-parties.

As a working manager, the positionisactively involved inrisk analysis and problem-solving while also guiding program execution, stakeholder engagement, and continuous improvement efforts.

The Governance, Risk, Compliance
- Audit team provides independent assessment and advisory services,facilitates compliance with regulatory and security requirements, performs assurance activities, and delivers information that enables informed business and risk decisions. Through collaboration, innovation, and practical risk management, the team helps protect SAS while enabling business success.

• Lead and continuously mature the information security risk management andthird-party security risk assessment programs, providing direction to team members while driving initiatives that enhance SAS's risk management program.
• Partner with business, technology, and service provider stakeholders to identify, assess,monitor, and manage information security risks.
• Monitor evolving regulatory and industry requirements affecting cybersecurity, technology risk, privacy, operational resilience, and third-party risk management, and incorporate applicable requirements into program practices.

• Perform information security risk assessments and document threats, vulnerabilities, controls, and residual risks across internal systems, cloud services, third-party vendors, and enterprise initiatives.
• Oversee risk assessment activities and risk treatment plans, ensuring clear ownership,timely remediation, and accountability for mitigation actions.
• Maintain and enhance risk management methodologies, risk scoring models, governance processes, and therisk register to support consistent and effective risk decision-making.
• Define, track, and communicate cybersecurity risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.

• Managethethird-party security risk assessment team, providing guidance on complex assessments and ensuring cybersecurity, privacy, compliance, and operational risks are consistently identified, evaluated, reported, and managed.
• Collaborate with Procurement, Legal, and Third-Party Risk Management (TPRM) stakeholders to integrate security and compliance requirements throughout vendor onboarding, contracting, and ongoing oversight processes.
• Define, track, and communicate third-party security risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.
  
  Embrace curiosity, passion,authenticity and accountability. These are our values and influence everything we do.

• Bachelor'sor Master’s degree in Business, IT, Cybersecurity, Project Manage mentor related field.
• Typically requires 4-8 years ofdemonstratedsuccess performing risk management.
  
  Experience in a regulated…