Impress employers and recruiters.
Choose from hundreds of resume examples.

Impress employers and recruiters.
Choose from hundreds of resume examples.

Target Resume Now

About the Role

The Senior Director, Information Security Governance & Risk will operationalize the vision set in collaboration with other Senior Team members and approved by Executive Leadership. This role ensures execution of Governance and Risk functions through a team of practitioners, working closely with stakeholders from Legal, Procurement, Information Security Office, Privacy, and Business Stakeholders.

Responsibilities

• Manage Governance and Risk (50%)
• Ensure policies and standards are maintained, updated, and operationalized by the organization.
• Oversee policy communication, awareness, and exception processes.
• Drive consistency in governance practices across the organization.
• Ensure effective delivery of the organization’s security awareness program.
• Oversee targeted training and campaigns aligned to key risk areas.
• Monitor engagement and effectiveness metrics.
• Ensure coordination of Business Continuity and Disaster Recovery governance activities.
• Oversee execution of BIAs, plan updates, and testing exercises.
• Track and drive remediation of identified gaps.
• Ensure the team maintains an accurate and actionable Information Security Risk Register.
• Oversee consistent risk identification, assessment, and documentation practices.
• Drive accountability for timely risk remediation and escalation.
• Support development of risk reporting for senior leadership consumption.
• Ensure consistent, high-quality execution of the third-party risk assessment program.
• Drive increased assessment throughput and reduced cycle times through team performance and process optimization.
• Oversee standardized approaches for SOC 2 reviews, control analysis, and risk evaluation.
• Ensure effective coordination with Procurement and business stakeholders.
• Identify and prioritize opportunities to scale Governance and Risk processes using automation and AI.
• Ensure successful implementation of tooling and workflow improvements (e.g., OneTrust, KnowBe4).
• Drive reduction of manual effort across assessments, evidence review, and reporting.
• Promote a culture of continuous improvement within the team.
• Establish and monitor KPIs/KRIs to track team performance and program effectiveness.
• Identify gaps and ensure implementation of scalable, sustainable improvements.
• Manage and lead a team of four that is responsible for Security Policy, Security Awareness, Business Continuity, Vendor Risk Management, and the Information Security Risk Register.
• Set vision and priorities for the team, track and manage progress to goals, and provide coaching and support to ensure team members meet and exceed goals, remain engaged, and contribute meaningfully to our mission and impact.
• Review Data Security language in critical procurement contracts.
• Review security requirements in RFPs.
• Develop risk language for state contracts.

Requirements

• 8-10+ years of progressive experience leading Governance and Risk functions.
• CRISC certification required.
• Bachelor’s degree required.
• Proven ability to support and deep practical knowledge of Security Policy, Security Awareness, Business Continuity, Vendor Risk Management, and Information Security Issue Management.
• Comfortable with change, a strong people leader and operator who can build structure, drive accountability, and increase program capacity through disciplined execution, process improvement, and the use of automation and AI.
• Ability to work effectively across technical and non-technical teams, including Legal, Procurement, Information Security, Privacy, engineering, operations, and business stakeholders, building trust and alignment while driving agreement on risk decisions, ownership, and remediation.
• Exceptional written and verbal communication skills, with the ability to explain complex security risks, audit findings, and control gaps to both technical audiences and senior leadership in a clear, concise manner.
• Strong planning, prioritization, and execution skills, capable of managing multiple concurrent audit timelines, remediation efforts, and control dependencies in fast-paced, evolving environments.
• Ability to communicate the value of governance and risk work in clear business terms, helping stakeholders understand how strong risk practices reduce organizational exposure, support resilience, protect trust, and advance College Board’s mission.
• A strategic and inclusive leadership style: you set clear priorities, build effective team structures, plan for future needs, and foster a culture of belonging.
• A proven ability to drive performance and growth: you set high expectations, deliver real-time, evidence-based feedback, and coach team members to take smart risks, stretch their skills, and achieve meaningful impact.
• A passion for expanding educational and career opportunities and mission-driven work grounded in our Operating Principles and Manager Expectations.
• Curiosity and enthusiasm for emerging technologies, with a willingness to experiment with and adopt new AI-driven solutions and comfort with learning and applying new digital tools independently and proactively.
• Clear and concise communication skills, written and verbal
• A learner's mindset and a commitment to growth: welcoming diverse perspectives, giving and receiving timely, respectful feedback, and continuously improving through iterative learning and user input.
• A drive for impact and excellence: solving complex problems, making data-informed decisions, prioritizing what matters most, and continuously improving through learning, user input, and external benchmarking.
• A collaborative and empathetic approach: working across differences, fostering trust, and contributing to a culture of shared success
• The ability to travel 3-4 times a year to College Board offices or on behalf of College Board business.
• Authorization to work in the United States

Skills

• Security Policy
• Security Awareness
• Business Continuity
• Vendor Risk Management
• Information Security Issue Management
• Automation
• AI Agents
• OneTrust
• KnowBe4
• Risk Reporting
• ISO 27001
• PCI-DSS
• SOC2
• Continuous monitoring capabilities
• External risk signals
• Ongoing vendor posture tracking

Location

• Remote

Work Type

• Full-time
• Remote
• Hybrid

Experience Level

• Senior
• 8-10+ years

Education Level

• Bachelor's degree
• Advanced degrees preferred

Salary/Compensations

• $120,000 – $195,000

Benefits

• Meaningful career
• Supportive team
• Comprehensive package designed to help you thrive

About the Company

• The Information Security Governance Risk and Compliance (ISGRC) team at the College Board works closely with other teams across the organization to assess and certify the security of College Board’s information systems and processes.
• This dedicated team facilitates information security governance and compliance by assessing College Board’s vendors, reviewing and negotiating contractual commitments to information security, planning for disaster response and recovery, testing system strength using industry-recognized frameworks (ISO 27001, PCI-DSS and SOC2) and obtaining related compliance certifications, implementing information security policies, promoting security awareness and training, and testing the acumen of College Board employees through robust and innovative training and phishing campaigns.
• College Board is a self-sustaining nonprofit that believes in fair and competitive compensation grounded in your qualifications, experience, impact, and the market.