> Markdown version of [/jobs/ext/3756917-associate-manager-it-governance-risk-compliance](https://www.wearedevelopers.com/jobs/ext/3756917-associate-manager-it-governance-risk-compliance). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Associate Manager, IT - Governance, Risk & Compliance

- **Company:** The Heinz Kraft Company
- **Location:** Chicago, IL, United States
- **Experience:** Experienced
- **Salary:** $89,800.0 - $112,200.0
- **Contract:** Permanent contract
- **Skills:** Cyber Security, National Institute of Standards and Technology Cybersecurity Framework
- **Published:** October 15, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=553961ca6e952f6f

## About the Role

* I have 4+ years of relevant information security experience.
 * I am familiar with Foundational security frameworks and regulations (e.g., NIST CSF, ISO 27,001 and GDPR).
 * I have exceptional written and verbal communication skills with the ability to translate security concepts into simple and actionable guidance for non-technical employees.
 * I have strong organizational skills and high attention to detail.
 * I have demonstrable skills in building relationships with the business and a willingness to learn.

## Description

You will play a critical role in strengthening and maintaining our organization's security posture. You will be responsible for managing the life cycle of security policy exceptions, assisting with third-party security risk assessments and continuous control maturity assessments and manage the security metrics program., * Manage and monitor the central GRC and security mailbox, acting as the first line of response for employee inquiries.

 * Administer the security policy exception lifecycle from initial request to final approval, extension, or remediation.
 * Review incoming exception requests to evaluate business justification against potential security risks.
 * Maintain the centralised security exceptions register, proactively tracking expiration dates and initiating review processes before the exceptions lapse.
 * Conduct reviews of vendor security documentation, including SOC 2 type 2 reports, ISO 27,001 certificates, penetration test summaries, and custom security questionnaires.
 * Identify, document, and communicate third party risks to business owners, and track vendor remediation efforts for any identified control gaps.
 * Collaborate with procurement and legal teams to ensure appropriate data protection and information security clauses are embedded in vendor contracts.
 * Initiate, conduct and manage cyber controls maturity assessments.