GRC Information Security Risk Manager

Description
About the firm:
Companies, investors and government entities around the world turn to Alvarez & Marsal (A&M) for leadership, action and results. Privately held since its founding in 1983, A&M is a leading global professional services firm that provides advisory, business performance improvement and turnaround management services. When conventional approaches are not enough to create transformation and drive change, clients seek our deep expertise and ability to deliver practical solutions to their unique problems.
With over 10,000 people providing services across six continents, we deliver tangible results for corporates, boards, private equity firms, law firms and government agencies facing complex challenges. Our senior leaders, and their teams, leverage A&M’s restructuring heritage to help companies act decisively, catapult growth and accelerate results. We are experienced operators, world-class consultants, former regulators and industry authorities with a shared commitment to telling clients what is really needed for turning change into a strategic business asset, managing risk and unlocking value at every stage of growth.
To learn more, visit: AlvarezandMarsal.com.
The team:
Alvarez and Marsal's Global Security Office is committed to delivering the highest standards of security and compliance. We are seeking a highly skilled and motivated Information Security Risk Manager to lead on A&M wide information security risk management program and join our dynamic and growing team based in either our London or Tampa office.
Position Summary:
The Information Security Risk Manager will play a critical role in, and will be responsible for, driving risk strategy, overseeing risk governance, managing senior-level reporting, and leading key information security risk initiatives across the Alvarez and Marsal.
This role will be focused on managing and maintaining the Global Security Office Information Security Risk Register, its supporting processes, governance and reporting requirements. The successful candidate requires a strong understanding of ISO 27001 security controls, exposure to the OnSpring GRC Tool and can effectively assess and communicate technical security requirements to teams across the firm.
Key Responsibilities:
Risk Management Leadership and Oversight:
Working to A&M Policy and industry standards and lead the end-to-end information security risk management process, ensuring risks are proactively identified, assessed, recorded, and mitigated.
Assess and prioritize security risks based on enterprise-wide impact, likelihood, and mitigation strategies.
Act as a trusted security advisor, working cross-functionally with IT, legal, compliance, Internal Audit, AI Centre of Excellence and other business leadership teams to drive a culture of risk awareness.
Ensure that all security risks align with regulatory requirements such as ISO 27001, NIST, GDPR, and other international security frameworks.
Provide oversight and work closely with risk owners to manage the development and implementation of treatment plans to address identified risks, ensuring alignment with senior leadership expectations and business objectives.
GRC Tool (OnSpring) Management:
Own, manage and continuously develop A&M GRC platform (OnSpring) to provide a structured, scalable risk register and reporting capabilities to support A&M wide requirements, and support ISO 27001:2022 certification requirements.
Risk Audit Requirements:
Complete annual formal risk assessment including control maturity assessment and asset register revision.
Work closely with Internal Audit to ensure audit compliance and delivery for ISO 27001.
Support ownership of minor non-conformities log of internal and external audit findings through to reporting, remediation and closure.
Attend ISO 27001 external audits for InfoSec Risk Management related compliance requirements.
Risk Governance:
Organize and facilitate bi-weekly Global Security Office Risk Management meetings, providing comprehensive tracking and updates on risk triage activities, critical risk register changes and general risk reporting mitigation strategies.
Prepare and deliver quarterly risk updates to the Information Security Steering Committee and executive leadership, providing strategic insights in information security against A&M Security Objectives.
Support risk input to bi-annual Executive Security Management Reviews.
Support Global Security Office SOC on Incident Response Leadership:
Provide GRC oversight during security incidents, guiding the organization’s response and ensuring effective risk mitigation and reporting.
Key Skills & Experience:
Experience in Information security risk management, governance, and compliance.
Proven leadership in enterprise risk management and security governance frameworks.
Hands-on exposure to GRC tools (e.g., OnSpring, Archer, ServiceNow, or similar).
Background knowledge of risk assessment methodologies and security frameworks such as ISO 27001, NIST, and CIS.
Experience managing and directing enterprise-wide Information Security risk triage, risk recording, treatment planning, and reporting.
Ability to translate complex security risks into actionable business strategies for executive stakeholders.
Strong analytical, strategic thinking, and decision-making skills.
Excellent written and verbal communication skills, with demonstrated experience presenting risk insights to executive leadership and board members.
Relevant senior security certifications (e.g., CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor) are highly desirable.

#J-18808-Ljbffr