Job Title: Director/VP – Compliance and Risk Management

Job Summary

Key Responsibilities

Compliance Program Development and Management

• Design, implement, and maintain a comprehensive compliance framework aligned with global regulatory requirements (e.g., ISO 27001, NIST, GDPR, HIPAA, SOX, FISMA, PCI-DSS).
• Develop and enforce corporate compliance policies, procedures, and ethical guidelines to ensure adherence to industry standards.
• Oversee internal and external compliance audits, identifying gaps and driving corrective actions.
• Establish and maintain internal controls to prevent fraud, misconduct, and regulatory violations.
• Serve as the primary liaison with regulatory bodies (e.g., SEC, FINRA, OCC, FDIC, FTC) and ensure timely and accurate regulatory filings.

Enterprise Risk Management (ERM) and Governance

• Develop and execute an Enterprise Risk Management (ERM) strategy to identify, assess, and mitigate risks across business functions.
• Establish a Risk Committee to align risk management efforts with business objectives.
• Conduct risk scenario planning, stress testing, and business impact analysis (BIA) to evaluate potential threats.
• Implement a risk reporting dashboard for executive leadership and board members to monitor real-time risk exposure.
• Oversee third-party risk management (TPRM) by assessing vendor, supply chain, and outsourcing risks.

Regulatory and Legal Compliance

• Monitor and interpret evolving global, national, and industry-specific regulations to ensure proactive compliance.
• Provide strategic legal guidance to executive leadership on regulatory matters.
• Oversee regulatory audits, investigations, and enforcement actions, ensuring proper remediation and reporting.
• Develop and manage whistleblower and ethics reporting programs to maintain corporate integrity.

Cybersecurity and Data Privacy Compliance

• Work closely with the CISO and IT leadership to enforce cybersecurity risk management policies.
• Ensure compliance with global data protection regulations (GDPR, CCPA, HIPAA) and implement necessary controls.
• Lead incident response planning and breach reporting, ensuring regulatory compliance.
• Develop data loss prevention (DLP) and encryption policies to protect sensitive company information.

Financial and Operational Risk Management

• Assess and mitigate financial compliance risks, including fraud prevention, anti-money laundering (AML), and financial reporting.
• Oversee Sarbanes-Oxley Act (SOX) compliance and ensure robust internal financial controls.
• Implement anti-bribery and anti-corruption programs in accordance with the Foreign Corrupt Practices Act (FCPA) and UK Bribery Act.

Compliance Training and Corporate Culture Development

• Design and implement comprehensive compliance training programs for employees, executives, and board members.
• Foster a corporate culture of compliance, ethics, and accountability through leadership initiatives.
• Utilize a Learning Management System (LMS) to track training participation and compliance certifications.

Crisis Management and Business Continuity

• Develop crisis management and business continuity plans to ensure operational resilience.
• Conduct tabletop exercises and emergency response simulations to test the company’s preparedness.
• Ensure compliance with disaster recovery (DR) and continuity of operations (COOP) frameworks.

Strategic Leadership and Stakeholder Communication

• Provide risk and compliance reports to the CEO, Board of Directors, and Risk & Audit Committees.
• Represent the company in industry conferences, regulatory forums, and professional associations.
• Engage with investors and shareholders to ensure transparency and regulatory confidence.

Skills and Knowledge Required

Regulatory and Compliance Expertise:

•  Extensive knowledge of global compliance frameworks (GDPR, HIPAA, SOX, SEC, NIST, ISO 27001).
•  Strong expertise in corporate governance, risk assessment, and regulatory reporting.
•  Experience in third-party compliance management and vendor risk assessment.

Enterprise Risk Management & Cybersecurity:

•  Proficiency in risk assessment methodologies and mitigation frameworks.
•  Strong understanding of cybersecurity frameworks (NIST Cybersecurity Framework, CIS Controls).
•  Experience in fraud detection, AML, and financial crime prevention.

Leadership & Strategic Thinking:

•  Proven ability to develop and lead high-performance compliance teams.
•  Strong communication skills for executive and board-level discussions.
•  Expertise in corporate ethics, internal investigations, and controls.

Analytical & Technological Skills:

•  Experience with Governance, Risk, and Compliance (GRC) platforms (Archer, MetricStream, OneTrust, LogicGate).
•  Proficiency in risk analytics, artificial intelligence (AI) in compliance, and predictive modeling.
•  Knowledge of cloud security compliance and data protection measures.

Educational Qualifications

•  Bachelor’s or Master’s degree in Law, Finance, Business Administration, Risk Management, or a related field.
•  MBA, JD (Juris Doctor), or a Master’s in Cybersecurity, Compliance, or Governance is highly desirable.

Preferred Certifications:

•  Certified Information Systems Auditor (CISA)
•  Certified in Risk and Information Systems Control (CRISC)
•  Certified Compliance & Ethics Professional (CCEP)
•  Certified Regulatory Compliance Manager (CRCM)
•  Certified Information Security Manager (CISM)
•  Certified Information Systems Security Professional (CISSP)

Key Focus Areas

• Developing and leading enterprise-wide compliance & risk strategies
• Ensuring business resilience against regulatory and cybersecurity risks
• Driving a corporate culture of integrity, transparency, and compliance

Experience Requirements

• 10+ years of experience in compliance, risk management, legal affairs, or regulatory oversight.
• Extensive experience in financial institutions, healthcare, telecommunications, or multinational corporations.
• Proven track record of leading regulatory audits, investigations, and enterprise risk programs.

Tools and Equipment

•  GRC Platforms: Archer, MetricStream, OneTrust, LogicGate
•  Risk Analytics & Compliance Reporting: Tableau, Power BI, SAS Risk Management
•  Cybersecurity & Privacy Tools: Splunk, IBM Guardium, Data Loss Prevention (DLP) tools
•  Regulatory Databases & Compliance Management Tools

Other Requirements

•  Ability to obtain and maintain regulatory certifications or government security clearances if required.
•  Strong crisis management skills and ability to lead in high-pressure environments.
•  Excellent negotiation skills for regulatory discussions and risk mitigation strategies.