GRC Manager - Technology Risk & Governance

• Own and manage the third-party risk management program, including risk-based vendor assessments, onboarding reviews, and periodic evaluations throughout the vendor lifecycle.

• Partner with Information Security, Legal, Compliance, IT, and business stakeholders to identify, assess, document, and mitigate technology, cybersecurity, privacy, AI, and vendor-related risks.

• Review SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration testing reports, business continuity plans, disaster recovery documentation, privacy materials, and related compliance evidence.

• Interface with third-party auditors, vendors, and internal stakeholders to gather documentation, respond to assessment requests, and support audit readiness.

• Support responses to technology-related third-party questionnaires, ensuring information is accurate, complete, consistent, and professionally documented.

• Maintain organized assessment records, risk documentation, compliance evidence, and supporting materials in accordance with internal policies and procedures.

• Prepare risk summaries, dashboards, reports, and governance materials for leadership and committee review.

• Maintain and support Pinnacle Group’s ISO 27001 certification and SOC 2 compliance in partnership with IT and other key stakeholders.

• Collaborate with cross-functional teams to create, maintain, and implement AI-related standards, procedures, and risk governance practices.

• Enhance and maintain Pinnacle Group’s business continuity plan in collaboration with appropriate business and technology stakeholders.