Manager, Security Governance & Risk

Lead, coach, and develop a team of GRC professionals by setting objectives, managing performance, and building career paths that deepen expertise across audit, privacy, and risk.

Own Emburse's GRC platform, including platform strategy, control architecture, integrations, data quality, automation, reporting, and continuous-control-monitoring maturity; delegate day-to-day platform administration and evidence operations to the team as appropriate.

Provide management oversight and quality assurance for security and compliance audits while delegating day-to-day audit planning, evidence coordination, auditor interaction, and execution; intervene directly on material findings, scope disputes, control deficiencies, or issues requiring management judgment.

Own the enterprise information security risk management program end to end, covering risk identification, assessment methodology, risk register maintenance, treatment planning, and tracking remediation to closure.

Continuously mature the risk program by improving the consistency, defensibility, and trend analysis behind how risk is scored and communicated, moving the organization beyond static point-in-time heat maps.

Own the Third-Party Risk Management program end to end, including vendor risk tiering, assessment methodology, due diligence standards, contractual security requirements, ongoing monitoring, and reassessment cadence, with ICs executing day-to-day vendor reviews and assessments against the standards and thresholds this role sets.

Build and own the security metrics and reporting framework, defining key risk and performance indicators, establishing authoritative data sources, and automating collection so reporting is repeatable rather than reassembled by hand each cycle.

Establish and lead Emburse's AI governance program, covering both AI capabilities within Emburse products and internal employee and vendor use of AI tools.

Track the evolving AI regulatory and framework landscape (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001, emerging state legislation) and translate obligations into concrete control and process requirements.

Own the security policy and standards lifecycle, ensuring alignment with industry frameworks (NIST, ISO 27001, PCI DSS, SOC 2) and keeping policies current, accessible, and enforceable.

Provide oversight of privacy program operations delivered by the team, ensuring obligations under GDPR, PIPEDA, CCPA/CPRA, and comparable regimes are met.

Partner with Engineering and Product on remediation of application and infrastructure security risk surfaced through risk assessments, penetration tests, and audit findings.

Sponsor continuous controls monitoring and automation initiatives that reduce manual evidence collection burden on the team and shorten audit cycles.

Required:  Bachelor’s Degree; minimum 7+ years of information security, risk, or compliance experience, including 2+ years directly managing people or demonstrated equivalent team leadership (owning workstreams, mentoring, and developing others).

Proven experience leading a security GRC function or team, with direct responsibility for the performance, development, and prioritization of team members.

Demonstrated ownership of an enterprise information security risk management program, including assessment methodology, risk register, and treatment tracking.

Strong track record building security metrics and reporting for executive, Board, or Audit Committee audiences, shaping what gets measured and why rather than only producing dashboards.

Working knowledge of security audit frameworks (PCI DSS, ISO 27001, ISO 27701, SOC 1, SOC 2, NIST, Tx-RAMP) sufficient to direct, quality-review, and defend audits executed by the team.

Familiarity with privacy frameworks and regulations (GDPR, CPRA/CCPA, PIPEDA) and how they translate into operational controls.

Experience with AI governance, AI risk assessment, or governance of other emerging technologies; familiarity with the EU AI Act, NIST AI RMF, or ISO/IEC 42001 strongly preferred.

Hands-on experience with GRC and compliance automation platforms (Drata, Vanta, or comparable), with enough depth to set direction and hold the team accountable for how the platform is configured and used.

Experience owning a third-party risk management program, including assessment methodology and vendor risk tiering, and managing commercial relationships with external audit firms, testing providers, and tooling vendors.

Demonstrable experience interacting with auditors and strategic partners in cloud-based environments similar to Emburse, relating to assurance frameworks such as SOX, PCI DSS, ISO 27001, SOC 2 Trust Principles, Business Continuity and Disaster Recovery, and Third-Party Risk Management.

Ability to remain organized and to elicit cooperation from a wide variety of sources, including team members, other internal departments, and external parties.

Ability to effectively prioritize and execute tasks in a high-pressure environment and react to project adjustments and alterations promptly and efficiently.

Ability to exercise good judgment and discretion in confidential matters.