Manager, GRC-; Information Security Risk

Manager, Information Security Risk – Governance, Risk, Compliance – Audit
- Hybrid, Cary, North Carolina

We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.

If you're looking for a dynamic, fulfilling career with flexibility and a world-class employee experience, you'll find it here. We're recognized around the world for our inclusive, meaningful culture and innovative technologies by organizations like Fast Company, Forbes, Newsweek and more.

The Manager, Governance, Risk, Compliance – Audit (GRC-A) is a hands on management role combining technical risk management expertise with people leadership, overseeing a team that evaluates information security and cybersecurity risks across SAS and our third-parties. As a working manager, the position is actively involved in risk analysis and problem-solving while also guiding program execution, stakeholder engagement, and continuous improvement efforts.

The Governance, Risk, Compliance
- Audit team provides independent assessment and advisory services, facilitates compliance with regulatory and security requirements, performs assurance activities, and delivers information that enables informed business and risk decisions. Through collaboration, innovation, and practical risk management, the team helps protect SAS while enabling business success.

• Lead and continuously mature the information security risk management and third-party security risk assessment programs, providing direction to team members while driving initiatives that enhance SAS's risk management program.
• Partner with business, technology, and service provider stakeholders to identify, assess, monitor, and manage information security risks.
• Monitor evolving regulatory and industry requirements affecting cybersecurity, technology risk, privacy, operational resilience, and third-party risk management, and incorporate applicable requirements into program practices.

• Perform information security risk assessments and document threats, vulnerabilities, controls, and residual risks across internal systems, cloud services, third-party vendors, and enterprise initiatives.
• Oversee risk assessment activities and risk treatment plans, ensuring clear ownership, timely remediation, and accountability for mitigation actions.
• Maintain and enhance risk management methodologies, risk scoring models, governance processes, and the risk register to support consistent and effective risk decision-making.
• Define, track, and communicate cybersecurity risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.

• Manage the third-party security risk assessment team, providing guidance on complex assessments and ensuring cybersecurity, privacy, compliance, and operational risks are consistently identified, evaluated, reported, and managed.
• Collaborate with Procurement, Legal, and Third-Party Risk Management (TPRM) stakeholders to integrate security and compliance requirements throughout vendor onboarding, contracting, and ongoing oversight processes.
• Define, track, and communicate third-party security risk metrics, key risk indicators (KRIs), dashboards, and assessment results through recurring reporting for senior leadership.

• Bachelor's or Master’s degree in Business, IT, Cybersecurity, Project Manage mentor related field.
• Typically requires 4-8 years of demonstrated success performing risk management. Experience in a regulated…