Want to know if this job is worth applying to?
Boston, Massachusetts, United States
Hybrid
The Manager, Security Governance & Risk leads Emburse's security governance, risk, and compliance function, with primary focus on enterprise security risk management, security metrics and reporting, and AI governance across both Emburse's AI-enabled products and internal AI use. This is a people-leadership role: the Manager leads a team of GRC professionals who independently manage day-to-day audit execution while the Manager owns the GRC operating model and platform strategy, governance, configuration standards, data integrity, automation, and reporting. This structure allows the Manager to focus on maturing how Emburse identifies, measures, and communicates security risk while maintaining accountability for the quality and effectiveness of the broader GRC program. The ideal candidate pairs credible GRC depth with genuine analytical rigor: someone who can turn control and risk data into decision-ready reporting for executives and the Board, establish governance for a fast-moving AI landscape, and grow the people on their team while doing it.
Lead, coach, and develop a team of GRC professionals by setting objectives, managing performance, and building career paths that deepen expertise across audit, privacy, and risk.
Own Emburse's GRC platform, including platform strategy, control architecture, integrations, data quality, automation, reporting, and continuous-control-monitoring maturity; delegate day-to-day platform administration and evidence operations to the team as appropriate.
Provide management oversight and quality assurance for security and compliance audits while delegating day-to-day audit planning, evidence coordination, auditor interaction, and execution; intervene directly on material findings, scope disputes, control deficiencies, or issues requiring management judgment.
Own the enterprise information security risk management program end to end, covering risk identification, assessment methodology, risk register maintenance, treatment planning, and tracking remediation to closure.
Continuously mature the risk program by improving the consistency, defensibility, and trend analysis behind how risk is scored and communicated, moving the organization beyond static point-in-time heat maps.
Own the Third-Party Risk Management program end to end, including vendor risk tiering, assessment methodology, due diligence standards, contractual security requirements, ongoing monitoring, and reassessment cadence, with ICs executing day-to-day vendor reviews and assessments against the standards and thresholds this role sets.
Build and own the security metrics and reporting framework, defining key risk and performance indicators, establishing authoritative data sources, and automating collection so reporting is repeatable rather than reassembled by hand each cycle.
Establish and lead Emburse's AI governance program, covering both AI capabilities within Emburse products and internal employee and vendor use of AI tools.
Track the evolving AI regulatory and framework landscape (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001, emerging state legislation) and translate obligations into concrete control and process requirements.
Own the security policy and standards lifecycle, ensuring alignment with industry frameworks (NIST, ISO 27001, PCI DSS, SOC 2) and keeping policies current, accessible, and enforceable.
Provide oversight of privacy program operations delivered by the team, ensuring obligations under GDPR, PIPEDA, CCPA/CPRA, and comparable regimes are met.
Partner with Engineering and Product on remediation of application and infrastructure security risk surfaced through risk assessments, penetration tests, and audit findings.
Sponsor continuous controls monitoring and automation initiatives that reduce manual evidence collection burden on the team and shorten audit cycles.
Education and Experience
Education:
Required: Bachelor’s Degree; minimum 7+ years of information security, risk, or compliance experience, including 2+ years directly managing people or demonstrated equivalent team leadership (owning workstreams, mentoring, and developing others).
Experience:
Proven experience leading a security GRC function or team, with direct responsibility for the performance, development, and prioritization of team members.
Demonstrated ownership of an enterprise information security risk management program, including assessment methodology, risk register, and treatment tracking.
Strong track record building security metrics and reporting for executive, Board, or Audit Committee audiences, shaping what gets measured and why rather than only producing dashboards.
Working knowledge of security audit frameworks (PCI DSS, ISO 27001, ISO 27701, SOC 1, SOC 2, NIST, Tx-RAMP) sufficient to direct, quality-review, and defend audits executed by the team.
Familiarity with privacy frameworks and regulations (GDPR, CPRA/CCPA, PIPEDA) and how they translate into operational controls.
Experience with AI governance, AI risk assessment, or governance of other emerging technologies; familiarity with the EU AI Act, NIST AI RMF, or ISO/IEC 42001 strongly preferred.
Hands-on experience with GRC and compliance automation platforms (Drata, Vanta, or comparable), with enough depth to set direction and hold the team accountable for how the platform is configured and used.
Experience owning a third-party risk management program, including assessment methodology and vendor risk tiering, and managing commercial relationships with external audit firms, testing providers, and tooling vendors.
Demonstrable experience interacting with auditors and strategic partners in cloud-based environments similar to Emburse, relating to assurance frameworks such as SOX, PCI DSS, ISO 27001, SOC 2 Trust Principles, Business Continuity and Disaster Recovery, and Third-Party Risk Management.
Ability to remain organized and to elicit cooperation from a wide variety of sources, including team members, other internal departments, and external parties.
Ability to effectively prioritize and execute tasks in a high-pressure environment and react to project adjustments and alterations promptly and efficiently.
Ability to exercise good judgment and discretion in confidential matters.
Certifications:
Preferred: CISSP, CRISC, CISA, CIPP/E, CIPM, AIGP, PMP
Required Skills:
Strong analytical skills, with comfort pulling, structuring, and interpreting control and risk data, and building reporting that withstands scrutiny from auditors, executives, and customers.
Ability to explain risk in business terms and write clearly for executive audiences without oversimplifying the underlying technical reality.
Genuine people-leadership instincts: delegates real ownership, coaches rather than corrects, gives direct feedback, and creates room for the team to grow.
Comfortable operating with ambiguity in a domain where standards are still forming, and able to make defensible decisions before consensus exists.
Ability to influence without authority across Engineering, Product, Legal, Finance, and Sales.
Sound judgment about where to apply rigor and where to accept risk, rather than defaulting to maximum control.
Experience working on large cross-functional teams, representing GRC on initiatives such as change management, identity and access management, policy management, and data retention.
Ability to develop creative and adaptive solutions to unique and complex inquiries.
Comfortable with a rapid-paced working environment and meeting deadlines.
Team-focused, positive attitude, and good sense of humor.