IT Project Manager (Governance, Risk and Compliance)

The ideal candidate is not solely an auditor, project manager, or compliance administrator. Georgia Tech is seeking a senior GRC practitioner who can independently assess current-state capabilities, design practical future-state processes, influence stakeholders without direct authority, and execute meaningful improvements in a complex institutional environment.

An exceptional candidate will be able to:

• Build and mature GRC programs, not merely operate them.
• Evaluate risk and compliance posture across multiple regulatory and control domains.
• Design practical, risk-based processes that reduce burden while improving assurance.
• Improve vendor and technology risk review processes so they are more consistent, efficient, and valuable to the institution.
• Develop credible AI governance and AI risk management capabilities.
• Produce executive-ready recommendations, roadmaps, dashboards, and decision materials.
• Navigate ambiguity, competing priorities, and decentralized decision-making.
• Balance cybersecurity risk management with Georgia Tech''s academic, research, administrative, and innovation missions

Direct the planning, execution and completion of large scale, technically complex programs and projects. Provide project management leadership for one or more multi-disciplined project teams comprised of technical and subject matter experts, engineers and project managers working in different phases of unrelated projects. Responsible for setting employee goals, assessing employee performance, providing feedback, and making pay recommendations. This position will interact on a consistent basis with: project team members, department heads and managers within OIT and other academic and business offices across campus; contractors and consultants. This position typically will advise and counsel: OIT management, user department heads. This position will supervise: Project team members.

Job Duty 1 -
Lead project teams through planning, assigning and overseeing diverse activities; define project goals, objectives, scope and estimates of schedules, resources and costs involving multiple projects being conducted simultaneously.

Job Duty 2 -
Direct project execution through continual coordination of planning, tasking, performance reporting, change control and issue management.

Job Duty 3 -
Confer with functional users within an assigned business or service area to develop plans to address business needs; develop and implement change management strategies.

Job Duty 4 -
Initiate communications among project teams, customers and appropriate levels of management.

Job Duty 5 -
Deliver project status reports and presentations.

Job Duty 6 -
Develop and manage project budgets.

Job Duty 7 -
Manage acquisition of project related goods and contract services.

Job Duty 8 -
Provide mentoring, training and career guidance for team members.

Job Duty 9 -
Perform other duties as assigned

The GRC Program Manager will:

• Lead the strategic maturation of Georgia Tech''s cybersecurity GRC function by applying advanced program management skills, regulatory and compliance expertise, and substantial practical experience in cyber risk and control governance.
• Define and maintain a cybersecurity GRC roadmap, operating model, process architecture, maturity targets, and success measures.
• Serve as a trusted advisor to cybersecurity leadership and institutional stakeholders on cyber risk, compliance, governance, control assurance, technology adoption, and emerging GRC issues.
• Maintain governance structures supporting cyber risk decision-making, escalation, prioritization, accountability, and executive oversight.
• Oversee control framework management, including control libraries, control mappings, evidence standards, assessment approaches, and issue remediation governance.
• Evaluate control effectiveness, identify gaps, and recommend enhancements to strengthen Georgia Tech''s cybersecurity risk posture and regulatory readiness.
• Oversee cyber due diligence and ongoing risk monitoring for third-party vendors, SaaS providers, cloud services, partners, and other strategic technology providers.
• Lead development of AI-focused cybersecurity GRC capabilities supporting Georgia Tech''s instructional, research, administrative, and operational functions.
• Develop executive-level reporting, dashboards, and briefings that provide meaningful insight into risk posture, control effectiveness, compliance readiness, issue remediation, and program maturity.
• Support audit, regulatory, and assurance activities by coordinating evidence, control narratives, issue remediation, and management responses.
• Identify opportunities to improve operational efficiency, reduce duplicative effort, automate repeatable GRC tasks, and responsibly apply AI or analytics to improve GRC program effectiveness.
• Foster cross-functional collaboration across cybersecurity, IT, legal, privacy, procurement, internal audit, compliance, research administration, data governance, accessibility, and other institutional stakeholders.
• Translate complex cybersecurity, regulatory, and technology risk issues into clear business terms for senior leaders, decision-makers, and non-technical stakeholders.

Educational Requirements
Bachelor''s Degree or an equivalent combination of education and experience

Required Experience
Eight years job related experience

The successful candidate will have:

• Bachelors degree in cybersecurity, information systems, business administration, public policy, risk management, computer science, or a related field.
• 10+ years of progressively responsible experience in cybersecurity, governance, risk management, compliance, audit, technology risk, or a related discipline.
• Proven experience building, transforming, maturing, modernizing, and materially uplifting cyber GRC programs in financial services, higher education, healthcare, government, technology, consulting, or other regulated sectors.
• Demonstrated deep GRC expertise, including controls, risks, testing approaches, evidence standards, control mapping, issue management, risk registers, POA&Ms, policy governance, vendor risk, and continuous monitoring.
• Hands-on implementation, assessment, or program leadership experience across multiple frameworks or regulatory domains, such as SOC 2, ISO 27001/27701, HIPAA, PCI-DSS, NIST, FERPA, GLBA, NIST Cybersecurity Framework, NIST SP 800-53, GDPR, or comparable requirements.
• Familiarity with applying AI, machine learning, analytics, or automation tools to GRC, risk management, compliance, audit, or operational workflows.
• Strong analytical and detail-oriented skills, including precise control wording, accurate requirement mapping, evidence specificity, issue documentation, and comfort working with spreadsheets and large data sets.
• Strong program management instincts, including the ability to define process, structure ambiguity, drive prioritization, track execution, and foster cross-functional collaboration.
• Demonstrated ability to communicate clearly and persuasively with senior leaders, technical teams, auditors, business stakeholders, and institutional partners.
• Ability to think strategically about institutional risk while connecting those risks to practical operational activities, controls, and decisions.
• Self-motivated, adaptable, and comfortable operating with a high degree of independence in a complex, decentralized environment.

Additional Preferred Qualifications
Project Management Institute/Project Management Professional; Building Industry Consulting Service International (BICSI)

Preferred Educational Qualifications
Master''s Degree

Preferred Experience
Seven or more years of job-related experience

Preferred qualifications include:

• Advanced degree in cybersecurity, information systems, public policy, law, business administration, risk management, or a related field.
• Experience in higher education, academic medical, research, government, consulting, financial services, or similarly complex regulated environments.
• Experience developing or operating integrated technology risk review, third-party risk, SaaS review, cloud review, or institutional technology approval processes.
• Experience developing AI governance, responsible AI, AI risk management, model risk, or AI-enabled technology review processes.
• Experience with GRC platforms such as ServiceNow GRC/IRM, Onspring, RSA Archer, OneTrust, MetricStream, AuditBoard, LogicGate, or similar tools.
• Experience with cloud and SaaS security risk assessment.
• Experience developing executive dashboards, risk reporting, control assurance metrics, audit readiness reporting, or compliance maturity reporting.
• Experience collaborating with privacy, legal, procurement, accessibility, data governance, export control, research security, internal audit, or institutional compliance stakeholders.
• Experience in decentralized organizations where influence, relationship-building, and stakeholder engagement are essential to program success.