Lead Information Security Auditor (GRC)

The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization's cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology (OT), and enterprise IT environments.

This role ensures the organization effectively manages cyber risk, complies with applicable regulatory and industry requirements, and maintains governance processes that protect intellectual property, patient safety, operational resilience, and business objectives. The position serves as a key liaison between cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators to ensure security requirements are embedded throughout the organization's operations and product lifecycle.

This role plays a critical part in enabling secure innovation, supporting regulatory readiness, managing enterprise cyber risk, and providing executive visibility into cybersecurity posture and compliance performance.

Key Responsibilities:

Cybersecurity Governance

• Lead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.
• Establish governance processes that align cybersecurity initiatives with business objectives and regulatory requirements.
• Maintain cybersecurity framework alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.
• Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.
• Facilitate cybersecurity steering committees and governance forums with senior stakeholders.
• Track remediation activities and ensure accountability for risk mitigation activities.

Enterprise Risk Management

• Lead enterprise-wide cybersecurity risk assessment and risk management programs.
• Establish and maintain a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
• Evaluate risks related to patient safety, operational resilience, intellectual property protection, regulatory exposure, and business continuity.
• Perform risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.
• Develop risk treatment plans and monitor mitigation efforts through completion.
• Translate technical security risks into business impact statements for executive leadership.

Regulatory Compliance & Audit Management

• Lead cybersecurity compliance efforts supporting SOX, ISO 27001, NIST, GDPR, NIS2, and applicable healthcare and manufacturing requirements.
• Coordinate internal audits, external audits, regulatory inspections, and customer security assessments.
• Manage evidence collection, control validation, and remediation tracking activities.
• Conduct control maturity assessments and gap analyses against regulatory and industry frameworks.
• Partner with Internal Audit, Legal, Compliance, and Regulatory Affairs to ensure ongoing compliance readiness.
• Oversee audit findings and corrective action plans through closure.

Third-Party Risk Management

• Lead cybersecurity due diligence and risk assessments for vendors, suppliers, manufacturing partners, and service providers.
• Establish third-party security requirements and contractual security obligations.
• Evaluate supplier security posture and monitor compliance with organizational requirements.
• Assess third-party risks impacting manufacturing operations, product development, cloud services, and intellectual property.
• Drive remediation and risk acceptance processes for identified supplier risks.

Product Security Governance

• Partner with Engineering, Product Development, Quality, and Regulatory Affairs teams to ensure cybersecurity requirements are incorporated throughout the product lifecycle.
• Oversee cybersecurity risk assessments for medical and surgical devices.
• Support secure development governance processes and cybersecurity documentation requirements.
• Ensure compliance with applicable device cybersecurity guidance and regulatory expectations.
• Facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.

Security Awareness & Compliance Culture

• Lead enterprise cybersecurity awareness, education, and compliance initiatives.
• Promote a culture of security accountability and risk ownership throughout the organization.
• Develop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams.
• Support phishing awareness, policy compliance, and security training programs.
• Measure and report on program effectiveness and compliance trends.

Business Continuity & Resilience Governance

• Partner with business continuity and disaster recovery stakeholders to ensure cyber resilience requirements are addressed.
• Support business impact analyses and resilience planning activities.
• Participate in tabletop exercises and cyber crisis management planning.

…