Director of Governance, Risk, and Compliance​/TPRM

Position: Director of Governance, Risk, and Compliance / TPRM
## Director of Governance, Risk, and Compliance / TPRMApplyremote type:
Hybrid Working locations:
United States;
Illinois time type:
Full time posted on:
Posted Todayjob requisition :
JR102440

Established in 2021,
** Independence Pet Holdings
** is a corporate holding company that manages a diverse and broad portfolio of modern pet health brands and services, including insurance, pet education, lost recovery services, and more throughout North America. We believe pet insurance is more than a financial product and build solutions to simplify the pet parenting journey and help improve the well-being of pets. As a leading authority in the pet category, we operate with a full stack of resources, capital, and services to support pet parents.

Our multi-brand and omni-channel approach include our own insurance carrier, insurance brands and partner brands. Director, Governance, Risk & Compliance (GRC) and Third-Party Risk Management (TPRM)

Location:

Chicago, IL (Hybrid)

Reports To:

Chief Information Security Officer (CISO)

Position Overview The Senior Director of Governance, Risk & Compliance (GRC) and Third-Party Risk Management (TPRM) is an enterprise leadership role accountable for the design, implementation, and continuous maturation of a unifiedrisk and compliance program across a $2.5 billion insurance holding company.

This position holds end-to-end accountability for the information security compliance posture of an organization comprised of 12 Managing General Agencies (MGAs) and 2 insurance carriers, operating within a complex and highly regulated environment.

Operating at the intersection of cybersecurity, regulatory compliance, and third-party governance, this leaderserves as the central authority for aligning disparate control environments into a cohesive, measurable, anddefensible enterprise risk framework. The role requires executive-level influence, regulatory fluency, and the ability to drive consistency across a federated, acquisition-driven operating model.

Key Responsibilities Enterprise Accountability & Regulatory Posture
• Own and maintain the enterprise-wide information security compliance posture across all operating entities, ensuring alignment with regulatory expectations and internal risk appetite.
• Establish a defensible, evidence-driven control environment capable of withstanding regulatoryscrutiny across multiple jurisdictions.
• Serve as the authoritative leader for compliance strategy across MGAs and carrier entities with differingregulatory obligations.

Enterprise GRC Strategy & Architecture
• Design and implement a unified GRC operating model across multiple insurance entities with varying levels of maturity.
• Establish a control-centric framework leveraging NIST 800-53, ISO 27001, SOC 2, and PCI DSS.
• Transition the organization from periodic, interview-based assessments to continuous, evidence-drivencompliance measurement.
• Define and operationalize KRIs, control effectiveness metrics, and executive reporting.

Regulatory & Audit Leadership
• Serve as the central point of accountability for regulatory readiness, including NYDFS, state insuranceregulators, and international frameworks where applicable.
• Lead enterprise-wide audit strategy (SOC 2 Type II, ISO 27001, internal audits).
• Interface directly with regulators and external auditors to ensure consistent narratives, defensiblecontrols, and successful audit outcomes.
• Drive enterprise remediation strategies with measurable timelines and executive accountability.

Third-Party Risk Management (TPRM)
• Build and scale a comprehensive TPRM program across the full vendor lifecycle.
• Establish risk tiering, due diligence, and continuous monitoring aligned with enterprise risk tolerance.
• Integrate TPRM into procurement, legal, and business…