Governance, Risk and Compliance Leader

Governance, Risk and Compliance Leader (USI9) (3229)# Governance, Risk and Compliance Leader (USI9) (3229)
Bloomfield, CT 06002;
Miramar, FL 33025;
Miami, FL 33122;
Davie, FL 33314;
Bedford, NH ;
Londonderry, NH ## Overview Salary Range$ - $ Salary/year Position Type Full Time Job Shift1st Shift Category Non  DOT - Safety Sensitive Position## Description
*
* SUMMARY:

** The Governance, Risk and Compliance (GRC) Leader is a subject matter lead for cybersecurity governance, risk and compliance and runs the GRC program day to day, reporting to the CISO, who retains decision authority and accountability for the program. This role architects and builds the program on the NIST Cybersecurity Framework (CSF) 2.0: documenting the company's current profile, defining a target profile with business stakeholders, and delivering a prioritized roadmap of projects to close each gap.

The core outcome of the program is fast, accurate and defensible responses to customer, partner, and prospect security questionnaires. The role also maintains the policy library and risk register, leads audits and control testing, manages security terms in third-party contracts in partnership with Legal, and supports CMMC and NIST SP 800-171 compliance for VSE's defense customers. The role operates with a high degree of autonomy, influences leaders across the business without direct authority, and is expected to build and lead the GRC team as the function grows.
*
* DUTIES & RESPONSIBILITIES:

** Responsibilities include, but are not limited to:
* Run the cybersecurity GRC program end to end, executing the program direction set by the CISO and recommending priorities, resourcing, and operating rhythm.
* Build and maintain VSE's NIST CSF 2.0 current profile by interviewing control owners across IT, Security, Legal, HR, Finance, Operations and the business units, and validating posture with evidence.
* Develop the target profile for CISO approval, working with business leaders, aligned to business risk, customer obligations, and regulatory requirements.
* Recommend and maintain a prioritized roadmap of projects, approved by the CISO, that closes the gaps between current and target profiles, track execution, and report progress.
* Maintain a unified control framework mapped across NIST CSF 2.0, ISO/IEC 27001, NIST SP 800-171 and other applicable frameworks, and use these crosswalks to demonstrate compliance to customers, partners and regulators (for example EASA Part-IS) and to answer questionnaires from a single control set.
* Lead responses to inbound security questionnaires and due diligence requests from customers, partners, and prospects (for example SIG, CAIQ and defense customer requirements), escalating new or non-standard attestations to the CISO for sign-off.
* Own the security Answer Bank and Trust Center content so responses are accurate, consistent, and timely.
* Maintain the enterprise cybersecurity risk register, including risk identification, scoring, treatment plans, and owners. Administer the risk acceptance workflow; acceptance decisions rest with risk owners and the CISO.
* Maintain the information security policy and standards library; coordinate annual review, approval, and communication.
* Run the policy exception process, including documentation, compensating controls, expiration and periodic review, routing exceptions for approval under defined authority levels.
* Support governance of AI use across VSE, including AI tool risk reviews, an inventory of approved AI tools, and alignment with emerging AI risk frameworks such as the NIST AI Risk Management Framework.
* Maintain the compliance calendar, coordinate control testing and evidence collection, and track findings to closure.
* Automate evidence collection and…