Director, Governance, Risk Compliance

Director, Governance, Risk, & Compliance What can Relias offer you?

• Fantastic health and wellness benefits package, including an outstanding 401k match, a flexible PTO program, and a generous and inclusive parental leave policy. Additionally, Relias pays for the employee portion of the monthly healthcare premium!
• Flexible work environment with onsite and work from home options – you choose when you want to come into the office!
• Active Employee Resource Groups open to all employees!
• Comprehensive onboarding program – a great introduction to our company, customers and culture!
• Growth and career advancement opportunities!
  • Promotes internal mobility and career growth aligned with evolving business needs
  • Multiple development program options – leadership development, professional development curriculums, and Nanodegree options in both technology and data science
  • Professional development gained from conference attendance and participation in organizations like NC Tech
  • Onsite 321 Coffee Shop providing free coffee and pastries to employees

• Lead the strategy, operating model, and maturity roadmap for governance, risk, and compliance programs.
• Develop, maintain, and enforce information security policies, standards, procedures, and guidelines aligned with regulatory and business requirements.
• Oversee enterprise risk management for cybersecurity, including risk identification, assessment, prioritization, treatment tracking, and reporting.
• Maintain a centralized risk register and ensure appropriate risk acceptance, mitigation, or transfer decisions are documented and approved.
• Lead internal and external audit readiness activities, including coordination of evidence collection, control validation, and remediation tracking.
• Manage compliance with applicable frameworks and standards such as NIST CSF, ISO 27001, SOC 2, HIPAA, PCI DSS, and other regulatory obligations as applicable.
• Oversee third-party risk management processes, including vendor assessments, due diligence, risk rating, and monitoring of remediation activities.
• Establish governance forums, reporting structures, and escalation pathways to support risk-informed decision-making and accountability.
• Develop and deliver risk reporting, dashboards, and executive communications that articulate control effectiveness, compliance posture, and residual risk.
• Partner with legal, privacy, human resources, and business stakeholders to ensure alignment on regulatory obligations and data protection requirements.
• Drive continuous improvement of controls, processes, and governance practices based on audit findings, risk trends, and evolving threats.
• Support customer-facing security and compliance inquiries, including RFPs, due diligence questionnaires, and assurance reporting.
• Manage technology platforms supporting GRC functions (e.g., risk management systems, policy tools, audit tracking solutions).
• Lead, coach, and develop GRC professionals while fostering a culture of accountability, transparency, and continuous improvement.

• 10+ years of progressive experience in cybersecurity, risk management, compliance, or related fields.
• 5+ years of leadership experience in a GRC or related cybersecurity function.
• Bachelor’s degree in Cybersecurity, Information Security, Information Technology, Business, or a related field; or equivalent professional experience.
• Demonstrated experience building or managing governance, risk, and compliance programs in a mid-sized or large organization.
• Experience supporting audits, regulatory inspections, and compliance assessments.
• Experience managing third-party risk and vendor assessment processes.
• Experience developing policies, standards, and enterprise risk frameworks.
• Experience partnering with executive leadership and cross‑functional stakeholders on risk and compliance initiatives.

• Master’s degree in Cybersecurity, Risk Management, Information Assurance, Business Administration, or related discipline.
• Professional certifications such as CISSP, CISM, CRISC, or CISA.
• Experience in SaaS, cloud‑native, or highly regulated industries.
• Experience aligning security and…