GRC Manager (Governance, Risk & Compliance Manager)

The role

The GRC Manager will own and mature the cybersecurity GRC program by establishing governance, policies, and standards. This role involves building risk processes, managing GRC tooling, and coordinating audits across various departments.

What you will do

• Own risk assessments across several departments and maintain the centralized risk register.
• Design and maintain a unified, original control framework tailored to the operating environment.
• Write and maintain policy to build security maturity.
• Manage GRC tooling and related workflows.
• Prepare for, coordinate, and help run third-party and certification audits.
• Act as the connective tissue between different departments to develop security and compliance requirements.
• Report regularly to the Program Director and executive stakeholders on risk posture and program maturity.
• Support customer, vendor, supplier, and subcontractor cybersecurity risk management.
• Coordinate cybersecurity audits, assessments, and remediation tracking with various teams.
• Perform control validation across company sites.

Required qualifications

• Bachelor’s degree or equivalent experience in computer science, cybersecurity, information security, Information Technology, Information Assurance, or a related field, or equivalent practical experien
• Must have experience managing teams.
• Deep knowledge of NIST CSF, NIST RMF, the ISO/IEC 27000 series, UK Cyber Essentials, CMMC/NIST 800-171, NIST 800-53.
• Experience selecting, implementing, or administering GRC tooling and workflows.
• Exposure to widely recognized governance, risk, and compliance frameworks spanning security, privacy, and quality management domains.
• Familiarity with OT/ICS security concepts.
• Minimum of 5 years hands-on GRC or compliance experience combined with prior experience in a DoD environment or military service.
• Has directly supported a third-party or certification audit from evidence collection through closure.
• Can apply recognized governance, risk, and compliance frameworks to design real, working controls tailored to a specific organization.
• Has performed or directly supported a formal risk assessment using a defined methodology.
• Occasional access to manufacturing floor environments, including required PPE and periods of standing or walking.

Nice to have

• Experience supporting third-party audits in a cloud-centric environment.
• Has built or materially contributed to a risk register, control framework, or compliance program.
• Has written policy or procedure documentation that a non-security audience could follow and act on.

Benefits

• Medical, dental, and vision benefits 100% paid for by the company
• 401k (+ 50% company match up to 6% of pay)
• FSA
• HSA
• life insurance
• Free daily lunch
• No meeting Fridays
• unlimited PTO
• casual dress code
• pre-IPO stock option grants
• relocation assistance
• annual bonuses (coming soon)

Before you apply

• CHAOS Industries does not accept unsolicited resumes or outreach.

About the company

CHAOS Industries is a modern defense company founded in 2022 that uses Coherent Distributed Networks (CDN™) to empower warfighters and commercial operators. The company is headquartered in Los Angeles with global offices.