Cyber GRC Lead

We are seeking a skilled and experienced Cyber GRC Lead to join Alice (Formerly ActiveFence) CISO team. The ideal candidate will be responsible for driving the security initiatives.

Key Responsibilities:

• Third-Party Risk Management (TPRM) & Supply Chain Security:
• Lead the end to end Operational TPRM lifecycle, assessing and continuously monitoring the security postures of vendors, SaaS platforms, AI tool providers.
• Establish risk criteria for third party tools, ensuring third party AI integrations do not introduce data leakage, or intellectual property risks.
• Security Awareness & Culture & Behavioral Programs:
• Design and manage the enterprise wide security awareness and training program using modern platforms.
• Conduct targeted phishing simulations, role based security training and specialized training among others on GenAI risks (prompt injection, shadow AI, data exposure).
• Customer Due Diligence (DDQs) & Sales Enablement:
• Manage and streamline the end to end customer security assessment process (DDQs, RFPs, Security Questionnaires, customer audits).
• Build and maintain a centralized, automated knowledge base to expedite responses, directly removing friction from sales velocity and supporting enterprise revenue goals.
• Risk Management Frameworks & Risk Advisory:
• Lead ongoing security risk assessments, maintaining a dynamic Risk Register mapped to real world business impacts.
• Provide continuous risk advisory services across business units, establishing risk treatment and mitigation plans that balance operational agility with guardrails.
• GRC Automation & Continuous Compliance:
• Architect and leverage high-level GRC automation tools to move from point in time audits to continuous control monitoring.
• Drive process automation for evidence collection, vendor assessments, and policy management to reduce manual overhead across technical teams.
• Compliance, Frameworks & AI Governance:
• Maintain core information security certifications (ISO 27001, SOC 2 Type II, etc)
• Build, operationalize, scale the organization's AI Governance Framework, referencing established benchmarks (NIST AI RMF, ISO/IEC 42001).
• Lead internal and external audit readiness, acting as the primary liaison for independent auditors.
• Close Collaboration with Legal, Privacy & DPO:
• Partner directly with Legal and Privacy teams to operationalize global data protection standards (GDPR, CCPA, EU AI Act) align security controls with contractual commitments.

Professional Experience:

• 4+ years of hands on experience in Cyber GRC, IT audit, or security consulting within global, fast paced technology companies.
• Proven track record of owning SOC 2 Type II and ISO 27001 compliance lifecycles.
• Direct experience partnering with Legal and Privacy teams on GDPR compliance and privacy risk assessments.
• Demonstrated track record handling customer DDQs, vendor security reviews (TPRM), and managing security awareness platforms.
• Technical, Automation & AI Capabilities:
• Strong technical proficiency in utilizing GRC automation platforms to automate control testing, evidence gathering, and vendor workflows.
• Working knowledge of cloud security (AWS/GCP/Azure), AI/ML operational risks
• Deep familiarity with core frameworks: NIST CSF, ISO 27001, NIST AI RMF, ISO 42001.
• Leadership & Stakeholder Management:
• Exceptional communication and negotiation skills, capable of translating complex security and compliance demands into clear business terms
• A pragmatic, business first mindset focused on designing guardrails that empower teams rather than introducing operational roadblocks.
• Fluent in professional English (written and verbal).

Preferred Qualifications (Pluses):

• Industry certifications: CISA, CRISC, CISM, CISSP, CIPP/E, or IAPP AIGP.
• Experience with automated TPRM and vendor intelligence solutions
• Practical scripting capabilities to custom build or tie together GRC automation workflows.