Director, Information Security Governance, Risk & Compliance

About the Team 

The Trust Engineering Team builds platforms used by all cloud engineers at Roku. Together, these components are designed to be a cost-effective and secure platform of services Roku engineers use globally. The Trust GRC team owns the following segments:

• Privacy
• Customer Trust
• Cyber Security Training
• Policy
• Vendor Management
• Compliance with PCI, SOX, and GDPR
• Risk Registry

Our team members are smart, collegial, collaborative, and focused on building the best-in-class platform. We foster a culture of experimentation, looking for the best idea to take the day. As a leader on this team, our Director, Development Operations, models this behaviour: If we’re not trying new things, we’re not growing. And, we need to grow and adapt so that Roku stays on top.

About The Role

The goal of GRC is to align IT, Development, and Operations with business goals while managing risks and meeting regulations. Assisting the organizations in avoiding poor and delayed decision making about cyber security risks. 

What You Will Be Doing

As Director, GRC, you will lead Trust’s  GRC organization. This role involves responsibilities in the following key areas: 

• Develop and implement security policies, standards, and guidelines
• Manage a team of GRC leaders
• Communicate security concerns and exposures
• Work with business and IT to deliver security solutions
• Identify and prioritize business risks
• Collaborate with stakeholders to implement security controls
• Maintain a risk repository
• Monitor compliance with laws and regulations
• SOX
• PCI
• GDPR / Privacy
• Develop strategies to improve governance practices
• Manage vendor security and risk assessments
• Manage corporate cybersecurity training
• Conduct annual tabletop exercises

We're Excited If You Have

Leadership Skills

• Expertise within a strategic engineering leadership role, setting vision and leading teams of 15+ people with excellent experience in leading and evolving managers.
• You enjoy building a world-class team, attracting, inspiring, and retaining top talent.  You will continue our build-out of a world class team of GRC analysist and engineers by attracting and hiring high quality talent across US, UK and India. We are expanding in India, so part of your time in this role will involve working closely with rest of engineering in supporting a development centre in India, and attracting the best talent there 

You have excellent soft skills and can effectively communicate and drive alignment with a diverse set of people, ranging from developers to Roku executives

• Demonstrated ability to engage senior leadership and drive strategic outcomes
• Demonstrated ability to work with internal users as customers
• You enjoy the challenge of building internal platforms, cross-team collaboration, influencing the direction of the work, and substantively contributing to system architecture
• Work with senior management and align roadmaps, communication strategy and evolution of platform based on their feedback and users of our platform 
• You are self-driven and enjoy taking complete ownership of initiatives

Business Skills

• Strong business acumen to quickly learn new business processes and understand how application performance requirements support the business in achieving revenue and profit goals
• Excellent collaboration skills – must be eager to work as part of a cohesive team and work as a partner to other teams within Roku, locally and globally
• Exceptional communication skills, including the ability to gather relevant data and information, actively listen, dialogue freely, verbalize ideas effectively, negotiate tense situations successfully, and manage and resolve conflict
• Proven presentation and facilitation skills
• Must excel working in team-oriented roles that rely on ability to collaborate with others
•  

Technical Skills

• Experience  within Cloud providers, like AWS, GCP and data canters
• Strong architectural abilities towards building a holistic experience
• Experience with Vendor Risk tools like SecurityScorecard, UpGuard, CyberGRX, or OneTrust
• Experience with AI to automate security processes
• Expertise leading cyber security or technology teams.
• Expertise of documenting and implementing security policies, standards, and/or controls.
• Prior experience leading GRC efforts / program.
• Expert understanding of security best practices including NIST CSF, NIST 800-53, ISO27001 and PCI DSS. Previous experience working with one of these frameworks.
• Knowledge of global regulatory standards and experience conducting assessments on SOX, PCI, GDPR
• Knowledge pertaining to global geographic data residency regimes
• Expert level of Information Security policy development and process creation
• Demonstrated ability to apply organizational information security policies
• Comfortable with interfacing with other internal or external organizations regarding security policy and standards violations, security controls failure, and incident response situations.
• Strong experience developing methods and procedures for risk analysis and mitigation to include Vulnerability Management (VM)
• IT Audit, internal Audit and/or risk advisory experience is a plus
• Experience in managing cyber security training programs
• Experience in developing and conducting tabletop exercises
• Bachelor’s in Computer Science, or equivalent work experience
• Ability to demonstrate security experience via certifications or significant career accomplishments.

#LI-AM3