Manager - Cybersecurity GRC Compliance

The Enterprise GRC (Governance, Risk, and Compliance) team functions as a second line of defense, responsible for developing and maintaining Enterprise Technology (ET) risk management and compliance in alignment with the organization's aligned framework. As regulatory landscapes grow more complex and cybersecurity threats continue to evolve, the need for a robust GRC framework has become mission-critical to the business.

The Cyber GRC Compliance & Certification Service Manager sits at the intersection of cybersecurity, regulatory compliance, and business operations — ensuring the organization maintains and demonstrates adherence to industry standards, regulatory requirements, and internal security policies. This role will lead efforts to continuously strengthen the organization's compliance posture across relevant frameworks (e.g., ISO 27001, SOC 2, NIST CSF, GDPR, CCPA, etc.) by managing certification lifecycles and serving as a key liaison between technical teams, auditors, and business stakeholders.

Responsibilities:

A particular focus of this role is driving the organization's certification expansion roadmap, maintaining continuous evidence readiness, and ensuring ongoing internal and external audit preparedness — while proactively monitoring and mitigating risks that could impact certification scope or annual audit outcomes.

• Audit & certification lifecycle management directs the end-to-end lifecycle of internal cybersecurity audits and compliance certifications, serving as the primary liaison for auditors while maintaining continued alignment with ISO27001, NIST CSF, SOC 2, CCPA and GDPR. 
• Certification expansion & readiness: Develops and executes a multi-year certification roadmap while driving continuous readiness through proactive gap analyses, mock audits, and a centralized, continuous evidence repository mapped to business and regulatory demands
• Certification risk assessment & mitigation: Leads enterprise risk assessments, including internal self-risk assessments to identify compliance gaps, maintaining a continuous risk register with clear mitigation timelines while driving cross-functional corrective actions (CAPAs) through verified closure. 
• Stakeholder Partnership & Governance: Partners cross-functionally with engineering, legal, IT, cybersecurity, and business leadership to embed audit readiness into daily operations, translating complex regulatory requirements into actionable guidance while continuously updating security policies and control narratives. 
• Automation & Continuous Improvement: Optimizes GRC tooling to automate compliance processes and continuous control monitoring, streamlining evidence collection while tracking emerging regulations to proactively adapt the certification roadmap.
• Reporting to Leadership: Delivers executive-level compliance metrics and risk dashboards that track certification roadmap progress, audit statuses, and open findings, providing leadership with the actionable visibility needed to support strategic decision-making

Basic Qualifications:

• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Risk Management, or equivalent professional experience.
• At least 5+ years of experience in cybersecurity compliance, GRC, IT audit, or certification management. 
• Demonstrated hands-on experience managing initial certification, scope expansion, and annual/surveillance audits, such as ISO 27001, SOC2, NIST CSF, or similar. 
• Proven experience building and maintaining audit readiness programs, including continuous evidence management processes.
• Proficiency with GRC platforms/tools for evidence, control management, and continuous monitoring (e.g., Archer GRC, ServiceNow GRC, OneTrust)
• Exceptional verbal and written communication skills to effectively translate technical issues to non-technical audiences.
• Experience directly interfacing with external auditors/certification bodies and managing audit logistics.
• Strong program management skills with the ability to balance multiple concurrent audit timelines.

Preferred Qualifications:

• Active industry credential certification such as ISO 27001 lead auditor/implementer, CISA, CRISC CISSP, or CISM. 

• Strong knowledge of NIST or ISO, and familiar with global data privacy regulations including GDPR, CCPA, and their intersection with technology risk management. 

• Experience operating within a three-line-of-defense(3LOD) risk governance model, particularly within a second-line GRC/risk oversight function. 

• Prior experience managing certification scope expansion (e.g., adding new sites, business units, or product lines to an existing certification with business/IT alignment) 

• Familiarity with continuous control monitoring (CCM) approaches and GRC tool compliance features.

• Experience managing relationships with multiple certification bodies/external audit firms simultaneously. 

• Background in leading mock audits or internal audit programs 

You may not check every box, or your experience may look a little different from what we've outlined, but if you think you can bring value to Ford Motor Company, we encourage you to apply!

As an established global company, we offer the benefit of choice. You can choose what your Ford future will look like: will your story span the globe, or keep you close to home? Will your career be a deep dive into what you love, or a series of new teams and new skills? Will you be a leader, a changemaker, a technical expert, a culture builder…or all of the above? No matter what you choose, we offer a work life that works for you, including:
• Immediate medical, dental, vision and prescription drug coverage
• Flexible family care days, paid parental leave, new parent ramp-up programs, subsidized back-up child care and more
• Family building benefits including adoption and surrogacy expense reimbursement, fertility treatments, and more
• Vehicle discount program for employees and family members and management leases
• Tuition assistance
• Established and active employee resource groups
• Paid time off for individual and team community service
• A generous schedule of paid holidays, including the week between Christmas and New Year’s Day
• Paid time off and the option to purchase additional vacation time.

This position is leadership level 6 and ranges from $115,500-$218,100.     
 

Final determination of salary grade will be based on candidate's skills and experience, and base salary will be set within the applicable range according to job scope, responsibility and competitive market value.

For more information on salary and benefits, click here: https://fordcareers.co/LL6

Visa sponsorship is not available for this position.

Candidates for positions with Ford Motor Company must be legally authorized to work in the United States. Verification of employment eligibility will be required at the time of hire.

We are an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, religion, color, age, sex, national origin, sexual orientation, gender identity, disability status or protected veteran status. In the United States, if you need a reasonable accommodation for the online application process due to a disability, please call 1-888-336-0660.

#LI-Remote

 #LI-GR1