Director, Governance, Risk & Compliance

Taft is seeking a Director, Governance, Risk & Compliance to join our team.

We are seeking a Director, Governance, Risk & Compliance to join our team.  This role is responsible for leading and maturing the firm’s information security governance, risk, compliance, and assurance programs.  All Taft employees operate under a “Client First” philosophy—in all things, we seek to provide exceptional services to our clients.

Duties, Tasks & Responsibilities:

GRC Program Leadership

• Develop, operate, and continuously improve the firm’s cybersecurity governance, risk, compliance, and assurance program.
• Establish and maintain an integrated control framework aligning applicable standards, regulatory requirements, contractual obligations, and client requirements
• Develop annual and multi-year GRC priorities and roadmaps in coordination with the CISO.
• Establish control ownership, evidence requirements, assessment processes, and ongoing compliance monitoring.
• Coordinate governance activities across Information Security, IT, Privacy, Information Governance, Legal, Procurement, Innovation, and business stakeholders.
• Advise the CISO on material compliance gaps, emerging requirements, risk trends, and matters requiring executive decisions.

ISO/IEC 27001 Information Security Management System

• Own the day-to-day operation and continual improvement of the firm’s ISO/IEC 27001 ISMS.
• Maintain ISO/IEC 27001 certification and coordinate surveillance and recertification activities.
• Manage the Statement of Applicability, control framework, control ownership, ISMS documentation, evidence requirements, and certification calendar.
• Coordinate internal audits, management reviews, corrective actions, and external certification audits.
• Expand the scope of the ISMS as the firm’s technology environment and business requirements evolve.
• Ensure nonconformities, control deficiencies, and improvement opportunities are documented, assigned, remediated, and validated.

Privacy Governance and ISO/IEC 27701

• Lead implementation and ongoing operation of an ISO/IEC 27701-aligned Privacy Information Management System (PIMS).
• Integrate privacy controls and requirements with the existing ISMS.
• Coordinate privacy risk and compliance activities with Privacy, Legal, and Information Governance stakeholders.
• Support Privacy Impact Assessments and Data Protection Impact Assessments, as applicable.
• Establish privacy control ownership, evidence, testing, monitoring, and remediation processes.
• Lead readiness for ISO/IEC 27701 certification if pursued by the firm.

Artificial Intelligence Governance and ISO/IEC 42001

• Lead implementation and ongoing operation of an ISO/IEC 42001-aligned AI Management System.
• Integrate AI governance with information security, privacy, vendor-risk, legal, and technology governance processes.
• Support risk assessments for AI technologies, vendors, features, and use cases.
• Establish AI control requirements, documentation standards, and evidence expectations.
• Maintain appropriate governance records for approved AI technologies and use cases.
• Track AI-related risks, exceptions, remediation activities, and risk decisions.
• Support committees and stakeholders responsible for evaluating and approving AI technologies.
• Lead readiness for ISO/IEC 42001 certification if pursued by the firm.

CMMC and CUI Compliance

• Provide GRC leadership for implementation and ongoing operation of the firm’s CMMC program and CUI enclave.
• Coordinate control implementation, assessment readiness, evidence collection, and compliance documentation with technical and business control owners.
• Maintain governance documentation supporting the CMMC environment, including the applicable system security documentation.
• Track control gaps, remediation activities, and Plans of Action and Milestones when applicable.
• Coordinate internal readiness reviews and external assessment activities.
• Establish processes supporting continued compliance after implementation or certification.
• Coordinate CUI governance requirements across Information Security, IT, Legal, Information Governance, and participating practices.

Cybersecurity Risk Management

• Own and maintain the firm’s information security and cybersecurity risk register.
• Establish a consistent methodology for identifying, analyzing, scoring, treating, accepting, and monitoring risk. o  Facilitate periodic cybersecurity risk assessments.
• Ensure risks arising from technologies, vendors, audits, client obligations, AI systems, regulatory requirements, and security assessments are appropriately documented.
• Coordinate risk treatment plans with accountable risk and control owners.
• Administer the security risk acceptance and exception process.
• Monitor aging and overdue remediation activities and escalate material issues.
• Develop risk metrics, Key Risk Indicators, Key Performance Indicators, and executive reporting.

Third-Party Risk Management

• Own and administer the firm’s cybersecurity Third-Party Risk Management program.
• Establish vendor-risk tiers and corresponding assessment requirements.
• Oversee cybersecurity due diligence for new and existing vendors and service providers.
• Evaluate security questionnaires, independent assurance reports, certifications, testing results, architecture information, data flows, and other relevant evidence.
• Identify vendor security risks and required remediation or compensating controls.
• Coordinate vendor risk acceptance and escalation processes.
• Establish risk-based reassessment and monitoring requirements.
• Coordinate TPRM activities with Procurement, Legal, Privacy, Information Governance, IT, and business owners. o  Develop metrics covering vendor assessment volume, risk, remediation, exceptions, and overdue assessments.

Client Requirements and Outside Counsel Guidelines

• Serve as the Information Security subject-matter expert supporting review of outside counsel guidelines and other client contractual requirements.
• Review proposed security, privacy, technology, incident notification, data handling, retention, AI, and related contractual requirements.
• Identify requirements that exceed or conflict with established controls or operating practices.
• Map material client requirements to the firm’s control environment and maintain records of material client-specific security obligations.
• Assist General Counsel and other stakeholders with technical analysis and proposed responses to security provisions.
• Monitor ongoing compliance with applicable security commitments. General Counsel retains approval authority for outside counsel guidelines.

Client Assurance

• Manage or coordinate responses to client information security questionnaires, assessments, audits, and due-diligence requests.
• Maintain reusable security and compliance response materials and an appropriate assurance package.
• Coordinate collection and validation of supporting evidence.
• Identify recurring client requirements and incorporate appropriate requirements into the control framework and security roadmap.
• Support inquiries concerning the firm’s certifications, controls, governance practices, and security posture.

Policy, Control, Audit, and Remediation Governance

• Own and coordinate the lifecycle of information security policies, standards, procedures, and related governance documentation.
• Establish document owners, review schedules, approval requirements, and version-control processes.
• Map policies and standards to security controls and compliance obligations.
• Manage policy exceptions and ensure appropriate risk review and approval.
• Coordinate periodic control assessments and testing.
• Maintain a centralized inventory of audit findings, assessment findings, control deficiencies, corrective actions, and remediation commitments.
• Validate remediation evidence before closure and escalate overdue or material findings.
• Identify systemic or recurring issues warranting broader corrective action.

Metrics and Executive Reporting

• Develop dashboards and reports describing the firm’s GRC and cybersecurity risk posture.
• Provide regular reporting on certifications, control effectiveness, risk, audit findings, third-party risk, client assurance activities, exceptions, and strategic compliance initiatives.
• Prepare materials supporting executive and governance committee meetings.
• Identify trends and areas requiring management attention.

Knowledge, Abilities, Skills, Interpersonal and Other Requirements:

• Deep understanding of governance, risk, compliance, and information security principles.
• Working knowledge of ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001, NIST Cybersecurity Framework, NIST SP 800-171, and CMMC.
• Strong knowledge of information security risk-assessment and control-assessment methodologies.
• Understanding of third-party and supply-chain cybersecurity risk.
• Ability to interpret complex client and contractual security requirements and translate them into control requirements.
• Ability to design rigorous governance processes without creating unnecessary administrative burden.
• Strong project and program management, analytical, problem-solving, documentation, and policy-writing skills.
• Ability to manage multiple concurrent audits, assessments, certifications, and remediation initiatives.
• Ability to influence stakeholders when direct organizational authority may not exist.
• Sound judgment and ability to distinguish material security risk from administrative compliance concerns.

Education and Experience:

Required

• Bachelor’s degree from an accredited institution in Information Security, Cybersecurity, Information Technology, Information Systems, Risk Management, Business, Accounting, Law, Privacy, or a related discipline; or an equivalent combination of education and substantial relevant professional experience.
• Ten or more years of progressive professional experience in information security, governance, risk, compliance, IT audit, privacy, or related disciplines.
• Five or more years of direct GRC, security assurance, risk, compliance, or audit leadership experience.
• Demonstrated experience operating or materially supporting an ISO/IEC 27001-certified ISMS.
• Experience managing security audits, assessments, corrective actions, and control evidence.
• Significant experience with cybersecurity risk-management processes and risk registers.
• Experience performing or managing third-party and vendor security risk assessments.
• Experience translating regulatory, contractual, or client security requirements into operational controls.
• Experience working across technical, legal, compliance, procurement, and business stakeholders.
• Strong written and verbal communication skills, including communicating risk and compliance issues to technical and nontechnical audiences.

Preferred

• Master’s degree in Cybersecurity, Information Assurance, Information Systems, Risk Management, Business Administration, Privacy, or a related discipline.
• Legal education may be advantageous for candidates with significant responsibility for contractual, privacy, regulatory, and client compliance matters but is not required.
• Experience leading expansion or implementation of ISO/IEC 27001, ISO/IEC 27701, or ISO/IEC 42001 management systems.
• Experience with CMMC and NIST SP 800-171 compliance programs.
• Experience within a large law firm, professional-services organization, financial institution, or comparably regulated and client-driven environment.
• Experience supporting client security assessments and contractual security requirements.
• Experience developing integrated control frameworks spanning multiple regulatory and certification requirements.
• Experience presenting risk and compliance information to executive leadership or governance committees.
• Experience with privacy and AI governance programs.

Professional Certifications

Required – At least one recognized senior-level security, risk, audit, or privacy certification, such as:

• CISSP — Certified Information Systems Security Professional
• CISM — Certified Information Security Manager
• CRISC — Certified in Risk and Information Systems Control
• CISA — Certified Information Systems Audit

Strongly Preferred

• ISO/IEC 27001 Lead Implementer or Lead Auditor
• ISO/IEC 27701 Lead Implementer or Lead Auditor
• ISO/IEC 42001 Lead Implementer or Lead Auditor
• IAPP CIPP/US — Certified Information Privacy Professional/United States
• IAPP CIPM — Certified Information Privacy Manager
• IAPP AIGP — Artificial Intelligence Governance Professional

Additional Preferred Qualifications

• Demonstrated experience with NIST SP 800-171 and CMMC.
• Formal CMMC assessment credentials are desirable when relevant to the assigned responsibilities but are not required.

Candidates interested in the Atlanta office should apply here.

Candidates interested in the Chicago office should apply here.

Candidates interested in the Cincinnati office should apply here.

Candidates interested in the Cleveland office should apply here.

Candidates interested in the Columbus office should apply here.

Candidates interested in the Denver office should apply here.

Candidates interested in the Detroit office should apply here.

Candidates interested in the Indianapolis office should apply here.

Candidates interested in the Minneapolis office should apply here.

Candidates interested in the Phoenix office should apply here.

Candidates interested in the Washington, D.C. office should apply here.

---

^{Taft is an Equal Opportunity Employer. The information in this posting presents general duties, tasks, and responsibilities but is not intended to be an exhaustive listing. Taft Stettinius & Hollister LLP participates in E-VERIFY.}