GRC & Compliance Lead

Key responsibilities

• Run security audits and compliance reviews: a NIST CSF 2.0 / SP 800-171 gap assessment, GLBA Safeguards Rule (16 CFR 314) review for Title IV student financial aid data, FERPA safeguards and PCI DSS scope if WWC takes card payments.
• Maintain the security control framework, compliance register and risk register; produce compliance and audit support documentation.
• Assess, write and revise cybersecurity policies, standards and procedures; how many policies are needed is set during Discovery & Assessment (Addendum 3, Q17).
• Support external audits, state or Wyoming Community College Commission reviews, cyber insurance questionnaires and HECVAT/vendor security reviews.
• Run the security awareness and training program for faculty, staff and administration (about 510 users): annual training, role-based modules and monthly phishing simulations, delivered through WWC's LMS or a managed platform, with completion and click-rate reporting.
• Lead DR/BC consulting: review existing plans, run business impact analysis, set recovery priorities and dependencies, review backup and recovery strategy, run tabletop exercises and recommend improvements (Addendum 3, Q9).
• Run third-party/vendor risk reviews for WWC's technology vendors.
• Deliverables owned: the compliance gap assessment, compliance and audit support documentation, the cybersecurity policy set (with the vCISO), security awareness training materials and reports, the business impact analysis, and BC/DR plan recommendations.

Skill set info

Experience: 10+ years in IT governance, risk and compliance or IT audit, including 4+ years in higher education or the public sector

Required qualifications

• 10+ years in GRC, IT audit or compliance, including 4+ years supporting colleges, universities or public agencies.
• Practical expertise in FERPA, GLBA Safeguards Rule, PCI DSS, NIST CSF and SP 800-53/800-171, and ISO 27001.
• Has written institution-wide security policies and BC/DR plans and run business impact analysis.
• Experience running security awareness platforms such as KnowBe4, Proofpoint or Microsoft Attack Simulation Training.
• Bachelor's degree in IT, Information Systems or Business; Master's preferred.

Preferred

• Experience with Title IV and Federal Student Aid cybersecurity requirements; prior community college compliance engagements.

Education

• Bachelor's degree in IT, Information Systems or Business; Master's preferred.

Certifications (if required)

• Certifications (required: at least one of): CISA, CRISC, CISSP.
• Preferred: CISM, ISO 27001 Lead Auditor or Lead Implementer, CBCP or MBCI, CDPSE or CIPP/US.