Impress employers and recruiters.
Choose from hundreds of resume examples.
Impress employers and recruiters.
Choose from hundreds of resume examples.
Target Resume Now
Tailor your resume to this Manager, IT Governance, Risk & Compliance role.
Rezi rewrites your resume against Four Seasons Hotels and Resorts's job description. Free.
Tailor your resume to this Manager, IT Governance, Risk & Compliance role.
Rezi rewrites your resume against Four Seasons Hotels and Resorts's job description. Free.
Don't guess if your resume is good enough.
See how it scores against the Manager, IT Governance, Risk & Compliance posting at Four Seasons Hotels and Resorts — free, in seconds.
Don't guess if your resume is good enough.
See how it scores against the Manager, IT Governance, Risk & Compliance posting at Four Seasons Hotels and Resorts — free, in seconds.
About the Role
The GRC Manager is responsible for leading governance and compliance initiatives across all properties and the home office, ensuring alignment with privacy regulations, PCI requirements, and internal policies. This role requires strong capabilities in PCI, IT, and cybersecurity risk management, and involves leveraging GRC tooling such as ServiceNow. The primary focus is leading and maintaining PCI Home Office compliance, while also managing compliance activities across properties globally.
Responsibilities
- Lead the Corporate Office PCI compliance Program, including defining, collecting, and conducting internal reviews for PCI compliance cycles and leading the annual PCI assessment.
- Schedule and participate in audit-related meetings to ensure consistent communication between teams and the QSA.
- Oversee remediation of audit findings and track progress to closure.
- Work closely with the QSA to ensure the successful annual renewal of the company’s AoC and RoC.
- Facilitate the Corporate annual tabletop major incident response exercise.
- Maintain and update the company’s IT policies, standards, and procedures; develop new documentation and RACI matrices; communicate changes; conduct reviews; and deliver ongoing training.
- Lead TID activities to ensure properties globally meet PCI compliance requirements and regulations.
- Identify opportunities to streamline property global compliance workflows and implement process optimizations or automation.
- Lead the annual Hotel Security Assessment program and guide properties on how to comply with control requirements.
- Manage HSA findings in ServiceNow and follow up with property stakeholders for timely remediation.
- Oversee PCI helpdesk tickets efficiently.
- Onboard new properties into the compliance program and deliver PCI compliance training and follow-up status calls.
- Monitor PCI compliance status across all properties and oversee the timely renewal of PCI self-attestations.
- Compile and communicate program metrics, providing the GRC Director with clear visibility into compliance trends and remediation progress.
- Maintain and enhance compliance dashboards, SharePoint sites, reports, and documentation.
- Onboard new corporate teams into the Change Management program and ensure alignment with established processes.
- Collaborate with stakeholders to ensure changes are properly endorsed and effectively communicated.
- Evaluate change requests to determine PCI significance, working closely with corporate PCI teams to ensure adherence to the internal PCI-significant change process.
- Lead and facilitate weekly CAB meetings, including preparing agendas, reviewing/approving change requests, and following up on pending requests.
- Support vendor selection activities by evaluating vendor capabilities, assessing risk and compliance alignment, and recommending solutions.
- Manage GRC vendor relationships to ensure solutions and services align with company needs.
- Conduct internal reviews and manage the renewal process for GRC-owned contracts.
- Support GRC Director in overseeing invoice tracking and budget reconciliation for the PCI program.
- Leverage GRC platforms such as RSA Archer, ServiceNow, MetricStream, Refinitiv, and OpenPages.
- Oversee helpdesk operations, ticketing, incident management, and IT service monitoring via dashboards.
- Collaborate across teams using internal sites and updating policies, standards, and procedures.
- Support PCI compliance by managing access, providing training, and guiding properties in the proper use of the PCI self-attestation tool.
- Resolve system and process issues while partnering with key stakeholders to support effective risk, compliance, and privacy governance.
- Identify opportunities to optimize internal processes and pursue automation to improve efficiency across risk, compliance, and privacy workflows.
- Identify, assess, and document cybersecurity and operational risks across systems, applications, vendors, and business processes.
- Conduct regular risk analyses aligned with recognized industry frameworks to evaluate control effectiveness.
- Translate technical findings into clear business impacts to support leaders and stakeholders.
- Monitor emerging threats, vulnerabilities, and regulatory requirements.
- Collaborate with technology and business teams to drive timely remediation of identified risks.
- Maintain and enhance risk registers, dashboards, and reporting mechanisms within the organization’s GRC tool.
- Advise teams on secure practices, policies, and control requirements to promote a strong risk-aware culture.
Requirements
- Minimum 5 years of experience with PCI standard and GRC methodologies.
- Bachelor’s degree or equivalent business qualifications.
- Experience operating in a global enterprise with complex, cross-functional dependencies, preferably within hospitality or retail PCI environments.
- Strong capabilities in PCI, IT, and cybersecurity risk management.
- Ability to assess, identify, track, and mitigate risks across diverse business units and operational areas.
- Skilled in developing risk remediation plans, driving them to completion, and maintaining ongoing compliance.
- Proficiency in the Microsoft Office suite.
- Experience managing compliance activities with centralized oversight across multiple business units and sites.
- Experienced in managing and reviewing IT change requests to assess compliance and risk impact.
- Experienced in preparing clear, well-structured technical documentation and tailoring content for both technical and non-technical audiences.
- Capable translating complex risk, compliance, and TID control concepts into practical guidance.
Skills
- PCI DSS
- IT Governance
- Cybersecurity Risk Management
- ServiceNow
- Microsoft Office suite
- COBIT
- ISO 27001
- ITIL
- NIST CSF
- NIST 800-30
- ISO 27005
- RSA Archer
- MetricStream
- Refinitiv
- OpenPages
- Risk Management
- Change Management
- Vendor Management
- Reporting & Analytics
- Attention to detail
- Stakeholder awareness
- Results-focused
- Analytical thinking
- Self-directed
- Improvement-oriented
- Organization
- Clear communication
Location
- Toronto, Ontario
Work Type
- Hybrid
- Contract
Experience Level
- Manager
Education Level
- Bachelor's degree or equivalent business qualifications
Salary/Compensations
- $85,000 - $125,000 CAD
Benefits
- Employment accommodation in accordance with the Ontario Human Rights Code and the Accessibility for Ontarians with Disabilities Act.
About the Company
- Four Seasons is a global, luxury hotel management company managing over 130 hotels and resorts and 50 private residences in 47 countries.
- Central to Four Seasons employee experience and social impact programming is the company’s commitment to supporting cancer research, and the advancement of diversity, inclusion, equality and belonging at Four Seasons corporate offices and properties worldwide.
- Four Seasons is powered by people and our culture enables everything we do.
Equal Opportunity
- Four Seasons is committed to providing employment accommodation in accordance with the Ontario Human Rights Code and the Accessibility for Ontarians with Disabilities Act. If contacted for an employment opportunity, please advise Human Resources if you require accommodation.