Manager, IT & Cybersecurity GRC
Role details
Job location
Tech stack
Job description
The Manager, IT & Cybersecurity GRC (Governance, Risk, and Compliance) leads the design, execution, and continuous improvement of enterprise technology controls and risk management programs. This role is accountable for managing IT SOX compliance, advancing enterprise risk management (ERM) initiatives, and strengthening cybersecurity governance across a highly regulated environment. You will partner crossfunctionally to translate risk into actionable insights, elevate control maturity, and support business growth while ensuring regulatory alignment.
This is a highly visible role that combines strong technical expertise with people leadership, program ownership, and strategic influence across Finance, Internal Audit, Engineering, and Executive leadership.
Core Responsibilities
- Lead and execute the IT SOX program, including annual scoping, risk assessments, control design, testing strategy, and deficiency remediation
- Own and continuously improve the IT General Controls (ITGC) framework (Access, Change Management, Operations, SDLC) ensuring alignment with SOX and COSO standards
- Serve as the primary liaison to Internal and External Audit, driving efficient audit execution and high-quality outcomes
- Partner closely with Finance and Internal Audit to co-develop control narratives, risk assessments, and audit committee materials
- Drive the evolution of the Enterprise Risk Management (ERM) program for IT and Cybersecurity risks, including facilitating cross-functional risk workshops and maintaining the enterprise risk register
- Translate technical risks into business-relevant insights and provide clear reporting to executive stakeholders, including the CIO and Audit Committee
- Lead risk lifecycle activities including risk identification, assessment, mitigation planning, and ongoing monitoring
- Establish and track key risk indicators (KRIs) and key performance indicators (KPIs) to measure program effectiveness and inform decision-making
- Author and maintain IT and cybersecurity policies, standards, and procedures to ensure compliance with regulatory and industry frameworks
- Evaluate and integrate GRC tools, automation, and analytics to enhance control monitoring and reporting capabilities
- Review and assess third-party risk through SOC1/SOC2 and other service provider assurance reports
- Lead and develop a small team (or provide functional leadership), fostering growth, accountability, and high performance
- Drive cross-functional initiatives and special projects that strengthen governance, risk posture, and operational resilience
Requirements
You are a collaborative and solutions-oriented leader who brings structure to complexity and thrives in a fast-moving, regulated environment. You balance technical depth with business acumen and are energized by building programs, partnering across teams, and developing others. You communicate with clarity, act with integrity, and embrace continuous improvement in everything you do., * 6+ years of progressive experience in integrated audit, regulatory compliance, cybersecurity GRC, or risk management
- Demonstrated experience owning and executing IT SOX / ITGC programs within a public company or SOX-regulated environment
- Hands-on experience with risk management frameworks (COSO, NIST RMF, ISO 27001/27005 or similar)
- Proven ability to lead cross-functional initiatives and drive alignment across Finance, Audit, Engineering, and Security teams
- Experience managing audits and serving as a primary point of contact for auditors
- Strong analytical and problem-solving skills with the ability to assess complex risks and design effective controls
- Experience mentoring or leading others, with a track record of developing talent and fostering strong team engagement
- Bachelors Degree in Accounting, Information Systems, Cybersecurity, or a related field, * Professional certifications such as CPA, CISA, CISSP, or CRISC
- Background in public accounting (Big 4 or large regional firm) with IT audit experience
- Experience in regulated industries such as healthcare, diagnostics, or financial services
- Experience implementing GRC tools and driving automation or continuous control monitoring (CCM)
- Ability to leverage emerging technologies, including AI-enabled tools, to enhance compliance and risk management processes
- Strong executive communication skills with experience presenting to senior leadership or audit committees
#LI-Remote
The final salary offered to a successful candidate will be dependent on several factors that may include but are not limited to years of experience, skillset, geographic location, industry, education, etc. Base pay is one part of the Total Package that is provided to compensate and recognize employees for their work, and this role may be eligible for additional discretionary bonuses/incentives, and restricted stock units. Pay range$145,000-$155,000 USD
Benefits & conditions
Veracyte is a growing company that offers significant career opportunities if you are curious, driven, patient-oriented and aspire to help us build a great company. We offer competitive compensation and benefits, and are committed to fostering an inclusive workforce, where diverse backgrounds are represented, engaged, and empowered to drive innovative ideas and decisions. We are thrilled to be recognized as a 2024 Certified Great Place to Work in both the US and Israel - a testament to our dynamic, inclusive, and inspiring workplace where passion meets purpose., $145,000.00