Governance, Risk & Compliance Manager

The GRC Manager is responsible for developing, implementing, and maintaining comprehensive governance, risk management, and compliance programs.

The position will work closely with stakeholders and vendors to ensure alignment with industry regulations, best practices, and organizational objectives.

Main Responsibilities

• Lead and manage Claire’s Governance, Risk, & Compliance program
• Develop and maintain information security policies, standards, and procedures aligned with industry best practices and collaborate with stakeholders as needed to do so
• Conduct and participate in risk assessments, working proactively with vendors and stakeholders to collect any necessary data
• Collaborating with stakeholders to develop and implement risk mitigation strategies and manage compliance initiatives
• Identifying and managing appropriate controls, policies, procedures, compliance metrics, monitoring, reinforcement, and enforcement activities.
• Create and deliver GRC updates to senior leaders, including : reports concerning compliance failures, breaches or incidents
• Ensure security controls are operating effectively by maintaining control documentation, performing periodic reviews, and coordinating with responsible parties to maintain compliance
• Ensure that the organization achieves a sufficient level of compliance with relevant information security and privacy-related obligations imposed by laws, regulations, standards, contracts, policies etc.
• Conduct regular internal audits and review to ensure that compliance procedures are followed
• Ensure employees are thoroughly updated about the organization’s policies, regulations, and processes, developing and delivering programs to do so
• Maintains awareness of regulatory developments and industry trends
• Work with internal stakeholders to document and ensure best practices for BCDR and identity and access management

Qualifications

• BS in Information Systems preferred but appropriate experience is acceptable.
• Excellent communication skills are needed with demonstrated ability to work with multiple organizational functions and levels
• Understand NIST framework and how it applies
• PCI assessment experience
• Excellent writing skills
• Certifications a plus; CISSP, CISA, or equivalent experience
• 5-7 years of experience in the risk assessment or auditing of complex IT systems
• 3-5 years of experience in Program Management, Governance or Compliance Management
• High level understanding of securing Hybrid Platforms
• Solid understanding of IT concepts and operations
• Knowledge of third-party auditing and cloud risk assessment
• Risk Assessment methodologies and best practices
• Risk Treatment and Remediation
• Experience working with and interacting with 3rd party auditors
• Working knowledge of Information Security best practices, audit frameworks and possibly privacy laws (e.g., familiarity with ISO 27000 series, SANS, NIST, OWASP Top 10, COBIT, CIS Top 20, PCI, CCPA, etc.
• Fundamental knowledge about GRC rules and regulations
• Bonus if you are familiar with conducting BIAs

Claire's is an equal opportunity employer committed to diversity, equity and inclusion and we encourage applications from members of all underrepresented groups, including those with disabilities.

We will accommodate applicants' needs, upon request, throughout all stages of the recruitment process. Please inform us of the accommodation(s) that you may require.