Senior IT Compliance, Risk & Vendor Governance Manager

We are seeking a Senior Vendor & Contract Manager reporting directly to the Chief Information Officer (CIO) to lead enterprise-wide vendor compliance, third-party risk management, IT audit readiness, and technology governance. This role will oversee vendor risk assessments, audit compliance, remediation activities, and IT security and privacy policy management across the organization’s technology ecosystem. The ideal candidate will have extensive experience in IT compliance, IT General Controls (ITGC), audit governance, third-party risk management, and regulatory security frameworks. The individual will collaborate with IT, Legal, Procurement, and executive leadership to strengthen compliance, mitigate risks, and maintain audit readiness. Responsibilities

• Lead Third-Party Risk Management (TPRM), including vendor assessments, risk scoring, qualification, and ongoing compliance monitoring.
• Oversee IT audit readiness and execution, reviewing SOC 1/SOC 2 Type II reports, ISO certifications, and independent security attestations.
• Manage audit findings and remediation activities, coordinating technical root-cause analysis, corrective action plans, and supporting evidence.
• Author, review, update, and maintain IT security, privacy, technology governance policies, standards, and standard operating procedures (SOPs).
• Ensure alignment with NIST frameworks, ISO 27001, and applicable state and federal regulatory requirements.
• Enforce IT General Controls (ITGC), access governance, and data protection requirements across internal systems and third-party vendor environments.
• Partner with Legal and Procurement to review and manage compliance exhibits, Data Processing and Data Sharing Agreements, Service Level Agreements (SLAs), and right-to-audit clauses.
• Develop and maintain executive risk scorecards, audit tracking dashboards, and compliance reporting.
• Advise the CIO on enterprise compliance posture, emerging risks, audit results, and risk mitigation strategies.
• Coordinate with IT and business teams to monitor compliance obligations and implement corrective measures.
• Maintain documentation and evidence supporting internal and external audits.
• Monitor vendor compliance and support continuous improvement of governance and risk management processes.

• 8+ years of experience in IT compliance, IT General Controls (ITGC), and audit governance within enterprise environments.
• Experience authoring and updating enterprise IT security, governance, and regulatory compliance policies.
• Experience managing audit finding remediation, technical root-cause analysis, and corrective action plans.
• Experience working with NIST security frameworks, including NIST SP 800-53 and NIST Cybersecurity Framework (CSF), and ISO 27001.
• Strong technical understanding of ITGC, access governance, data protection, and enterprise compliance controls.
• Experience presenting compliance status, risk metrics, and audit findings to executive leadership.
• Strong analytical, documentation, communication, and stakeholder management skills.

Preferred Qualifications

• Experience in Third-Party Risk Management (TPRM) and cloud/SaaS vendor qualification.
• Experience evaluating SOC 1/SOC 2 Type II reports and independent security attestations.
• Experience working with cloud providers, software vendors, system integrators, and other third-party technology partners.
• Experience collaborating with Legal and Procurement on vendor contracts, data protection agreements, SLAs, and audit rights.
• Experience developing executive compliance dashboards, risk scorecards, and remediation tracking reports.
• Bachelor’s degree required.