GRC & Compliance Lead

Key responsibilities:

• Run security audits and compliance reviews: a NIST CSF 2.0 / SP 800-171 gap assessment, GLBA Safeguards Rule (16 CFR 314) review for Title IV student financial aid data, FERPA safeguards and PCI DSS scope if WWC takes card payments.

• Maintain the security control framework, compliance register and risk register; produce compliance and audit support documentation.

• Assess, write and revise cybersecurity policies, standards and procedures; how many policies are needed is set during Discovery & Assessment (Addendum 3, Q17).

• Support external audits, state or Wyoming Community College Commission reviews, cyber insurance questionnaires and HECVAT/vendor security reviews.

• Run the security awareness and training program for faculty, staff and administration (about 510 users): annual training, role-based modules and monthly phishing simulations, delivered through WWC's LMS or a managed platform, with completion and click-rate reporting.

• Lead DR/BC consulting: review existing plans, run business impact analysis, set recovery priorities and dependencies, review backup and recovery strategy, run tabletop exercises and recommend improvements (Addendum 3, Q9).

• Run third-party/vendor risk reviews for WWC's technology vendors.

Deliverables owned: the compliance gap assessment, compliance and audit support documentation, the cybersecurity policy set (with the vCISO), security awareness training materials and reports, the business impact analysis, and BC/DR plan recommendations.

Skill set info     Experience: 10+ years in IT governance, risk and compliance or IT audit, including 4+ years in higher education or the public sector

Required qualifications:

• 10+ years in GRC, IT audit or compliance, including 4+ years supporting colleges, universities or public agencies.

• Practical expertise in FERPA, GLBA Safeguards Rule, PCI DSS, NIST CSF and SP 800-53/800-171, and ISO 27001.

• Has written institution-wide security policies and BC/DR plans and run business impact analysis.

• Experience running security awareness platforms such as KnowBe4, Proofpoint or Microsoft Attack Simulation Training.

• Bachelor's degree in IT, Information Systems or Business; Master's preferred.

Preferred:

Experience with Title IV and Federal Student Aid cybersecurity requirements; prior community college compliance engagements.

Education       

Bachelor's degree in IT, Information Systems or Business; Master's preferred.

Certifications (if required)     

Certifications (required: at least one of): CISA, CRISC, CISSP.  

Preferred: CISM, ISO 27001 Lead Auditor or Lead Implementer, CBCP or MBCI, CDPSE or CIPP/US.