Security Supply Chain, GRC Lead JD

Erebor Security Supply Chain, GRC Lead

Location: New York City, NY, Newport Beach, CA or Columbus, Ohio

About the Role

Security Supply Chain / Security GRC Lead is a senior, hands-on role responsible for establishing, maturing, and directing Erebor Bank’s security governance, risk, and compliance programs, as well as the third-party and supply chain security function. This leader will define strategic direction, develop program frameworks, and build out the teams and processes necessary to manage information security risk across the enterprise and its extended vendor ecosystem. Reporting to the CISO, you will translate regulatory requirements and industry standards into actionable programs that protect the bank’s assets, customers, and reputation.

Key Responsibilities

Security Governance, Risk & Compliance (GRC)

• Design and implement the enterprise security GRC program strategy, including policy frameworks, risk assessment methodologies, and compliance monitoring capabilities.
• Develop and maintain the bank’s information security policy suite, ensuring alignment with regulatory requirements (OCC, FFIEC, GLBA, SOX IT controls,
• PCI DSS, NYDFS 23 NYCRR 500) and industry frameworks (NIST CSF, ISO
• 27001/27002, CIS Controls).
• Build and lead the security risk management function, including development of risk registers, risk appetite statements, key risk indicators (KRIs), and risk reporting to senior leadership and the Board.
• Establish and oversee security exception and waiver management processes with appropriate escalation, tracking, and remediation timelines.
• Own the second line of defense security audit and examination lifecycle, serving as the primary liaison with compliance, internal audit, external auditors, and regulatory examiners on information security matters related to TPRM and controls.
• Drive continuous improvement of GRC tooling, automation, and metrics to mature program capabilities and demonstrate measurable risk reduction.
• Security Supply Chain & Third-Party Risk Management
• Establish and lead the third-party security risk management (TPSRM) program, including assessment frameworks, tiering methodologies, and ongoing monitoring processes for vendors, partners, and service providers.
• Define security requirements for vendor contracts, SLAs, and due diligence processes in collaboration with Legal, Procurement, and business stakeholders.
• Develop and implement a supply chain security strategy addressing software supply chain risks (SBOM management, open-source risk, secure SDLC integration) and critical infrastructure dependencies.
• Oversee vendor security assessment operations, including questionnaire management (SIG), evidence review, on-site assessments, and continuous monitoring using threat intelligence and external rating services.
• Build processes for fourth-party (sub-contractor) risk identification and concentration risk analysis across critical service providers.
• Coordinate incident response activities with the CISO, SecOps, Enterprise Risk and others regarding third-party breaches or supply chain compromises, ensuring timely notification and remediation.
• Program Development & Leadership
• Recruit, develop, and lead a high-performing team of GRC analysts, supply chain security specialists, and compliance professionals.
• Establish program charters, operating models, RACI matrices, and success metrics for all functions under this role.
• Collaborate cross-functionally with Technology, Legal, Risk Management, Internal
• Audit, Procurement, and business lines to embed security governance across the organization.
• Provide regular reporting and risk briefings to the CISO, executive leadership, risk committees, and Board-level audiences.
• Manage program budgets and vendor relationships for GRC and supply chain security tools and services.

Experience Required

• 7+ years of progressive experience in information security and/or IT Audit, with at least 5 years in GRC, third-party risk management, or security program leadership roles.
• Deep knowledge of financial services regulatory landscape (OCC, FFIEC, GLBA,
• PCI DSS, SOX, NYDFS) and experience navigating regulatory examinations.
• Demonstrated experience building or significantly maturing security GRC or supply chain security programs from the ground up.
• Strong understanding of risk management frameworks (NIST CSF, NIST 800-53,
• ISO 27001, FAIR, COBIT) and their practical application in enterprise environments.
• Experience managing and developing teams of security professionals (direct reports and matrix leadership).
• Excellent executive communication skills with the ability to translate complex security risks into business terms for senior leadership and Board audiences.
• Bachelor’s degree in Information Security, Computer Science, Risk Management, or a related field (or equivalent experience).
• Bonus: Industry certifications such as CISSP, CRISC, CISM, CISA, CTPRP, or
• C3PAO. Hands-on experience with GRC platforms (Vanta, ServiceNow GRC,
• Archer, OneTrust) and third-party risk tools (BitSight, SecurityScorecard,
• Prevalent, ProcessUnity). Familiarity with software supply chain security practices (SBOM, SLSA, SSDF). Master’s degree or MBA.