GRC Lead - CIO Enterprise Risk Management Group

Pueo is known for bringing the best talent and unique tools to every opportunity. Pueo's Parliament (aka workforce) is composed of professionals who are seeking the opportunity to work in a business organization that thrives on career development and independence. In support of mission and professional growth, our Parliament has supported the development of multiple patents, proprietary tools, and applications as well as trademarked processes.

Our organization emphasizes career development across multiple career environments (at the members own pace) and ensures those who contribute broadly are properly rewarded. Pueo has four career environments where every member of the parliament can participate. Each environment has opportunities available for all levels. Opportunities are framed by an employee's desires and capabilities, and we ensure challenges, growth, and unique experiences are available for employees at all levels.

Our Career Environments (Program, Functional, Service, and Leadership) provide numerous opportunities for employees to invest in their personal growth and those things that offer fulfillment. We invest in helping our members create and execute their career development plans. Our Pods (small teams of 5 or less) are comprised of personnel with similar skillsets to ensure mentorship, understanding, and peer support.

The GRC Lead – CIO Enterprise Risk Management Working Group serves as the Governance, Risk, and Compliance (GRC) Lead responsible for providing strategic oversight and coordination for implementation of the Defense Intelligence Agency's enterprise cybersecurity risk management framework. This position leads the CIO Enterprise Risk Management Working Group (CERMS WG) and provides senior-level program management, governance, policy development, and stakeholder coordination supporting enterprise and system-level cybersecurity risk decisions.

The GRC Lead works closely with CIO-4 leadership, CIO-5 Strategy & Programs Office (SPO), the Chief Risk Officer (CRO), CIO Risk Owners, and stakeholders across the Agency to establish risk tolerance matrices, decision frameworks, escalation protocols, governance processes, and executive reporting mechanisms. The position facilitates enterprise consensus on cybersecurity risk management methodologies and ensures the Agency has repeatable, defensible processes for evaluating, accepting, escalating, and communicating cybersecurity risk.

• Lead implementation and maturation of the CERMS WG Charter and associated enterprise cybersecurity risk governance framework.
• Provide strategic program management and oversight for enterprise cybersecurity risk management initiatives.
• Coordinate with CIO-5 Strategy & Programs Office on strategic risk management priorities and activities.
• Develop and maintain comprehensive project plans, milestones, action items, and implementation schedules.
• Provide recurring program status, risk, and performance reporting to CIO-4 leadership.
• Coordinate stakeholder engagement across CIO organizations, SPP/DDI, Deputy Directors, J2s, Director-level leadership, and other Agency stakeholders.
• Lead development of CIO-level Administrative Instructions, governance documentation, and supporting enterprise risk management policies.
• Develop CIO-4 Standard Operating Procedures (SOPs) governing cybersecurity risk tolerance decisions and supporting processes.
• Define and document escalation protocols, decision authorities, and organizational responsibilities for enterprise and system-level risk decisions.
• Coordinate policy review, adjudication, concurrence, and approval processes across Agency stakeholders.
• Guide CERMS WG meetings and facilitate executive and cross-directorate stakeholder discussions.
• Establish working group agendas in coordination with the CRO, Risk Leads, and other key stakeholders.
• Coordinate with CIO Risk Owners across divisions to ensure effective participation and execution of risk management activities.
• Facilitate consensus on enterprise cybersecurity risk methodologies, thresholds, decision processes, and reporting requirements.
• Oversee development and maintenance of enterprise risk tolerance matrices and decision-support frameworks.
• Direct development and maintenance of risk management dashboards and executive reporting mechanisms.
• Ensure effective configuration management, version control, storage, and accessibility of program artifacts.
• Maintain or oversee meeting minutes, decision records, action tracking, and…