Governance, Risk, and Compliance Manager

Job Title:                                Governance, Risk, and Compliance Manager

Reports To:                            Director of Cybersecurity & Compliance

FLSA Status:                          Exempt

Location:                                Shared Services Office, Irving, TX

 

Summary:

The Governance, Risk, and Compliance (GRC) Specialist supports the organization’s information security and enterprise risk management programs by facilitating risk identification, control assessment, policy governance, and compliance activities across regulatory and internal frameworks. This role partners with business and technology stakeholders to ensure risks are documented, evaluated, and treated in alignment with organizational risk tolerance, while enabling consistent, auditable processes for compliance, third-party risk, and control monitoring. The GRC Specialist plays a critical role in translating regulatory and security requirements into actionable controls, maintaining accurate risk and compliance artifacts, and supporting leadership with timely, data-driven reporting to inform risk-based decision-making.

Essential Duties and Responsibilities:

Governance

• Support the development, maintenance, and lifecycle management of information security and IT governance policies, standards, and procedures.
• Coordinate periodic policy reviews and facilitate stakeholder input, approvals, and attestations.
• Maintain policy exceptions and waivers, ensuring appropriate risk evaluation, documentation, and executive approval.
• Partner with legal, compliance, IT, and security teams to ensure governance alignment across enterprise initiatives.
• Lead and coordinate the Business Impact Analysis (BIA) process by partnering with business and technology stakeholders to identify critical processes, assess operational, financial, and regulatory impacts, and document recovery objectives to support enterprise resilience and continuity planning.

Risk Management

• Identify, assess, and document information technology risks across infrastructure, applications, cloud services, and third-party environments using standardized risk assessment methodologies.
• Facilitate periodic and ad-hoc IT risk assessments, including inherent risk evaluation, control effectiveness testing, and residual risk determination.
• Maintain the enterprise IT risk register by ensuring risks are accurately described, consistently scored, and aligned to business impact and risk tolerance.
• Track risk remediation activities to completion and validate that corrective actions effectively reduce risk exposure.
• Support third-party and vendor risk assessments by evaluating IT-related risks associated with external service providers.
• Support continuous improvement o