Senior Director, BT Risk Management – GRC Cyber Security

Job Description

IT Risk Principal, BT Risk Management | Workday

The Tone:
This is a full-time role at Workday, located in Pleasanton, CA with a hybrid work model. Workday builds a leading AI platform for managing people, money, and agents, shaping the future of work. This role is crucial for ensuring the highest compliance and risk management standards within Workday’s BT and Enterprise teams, guaranteeing secure-by-design application deployments and robust security hygiene. The company fosters a culture rooted in integrity, empathy, and shared enthusiasm, seeking curious and courageous collaborators.

The TL;DR
• Role: Full Time
• Type: Full-time
• Location: Hybrid – Pleasanton, CA
• Pay: $154,300 USD – $274,100 USD yearly
• Team: BT Risk Management, part of the CIO org under the Strategy and Operations pillar
• Mission: Ensure the highest compliance and risk management requirements are met for secure-by-design application deployment and robust security hygiene.
• Tech Stack: GRC platforms, risk management tools

What You’ll Actually Do
• Program Leadership: Design, develop, and launch new governance, risk, and compliance initiatives to standardize methodologies across the organization.
• Stakeholder Engagement: Build strong partnerships with business leaders, security partners, and employees to foster a collaborative and supportive GRC environment.
• Performance Measurement: Establish Outcome-Driven Metrics to evaluate program effectiveness and refine initiatives based on data-driven insights and organizational feedback.
• Strategic Compliance: Lead change management efforts to drive adoption of new security behaviors and processes, and enhance compliance strategies based on industry trends and regulatory activity.
• Security Assessment: Work with various business units and stakeholders to assess security issues/gaps, communicate their business impact, and agree on remediation actions and timelines.

The Must-Haves
• Background: Bachelor’s degree in Business Administration, Law, Finance, Information Security, or a related discipline, with a focus on GRC, organizational compliance, and cybersecurity governance.
• Experience: 12+ years experience in GRC, leading GRC initiatives, developing and maintaining GRC frameworks, and supporting organizational compliance with applicable laws and regulations. 12+ years of experience in GRC platforms, risk management tools, and regulatory reporting requirements.
• Skills: Expert-level understanding of Audits Compliance and the proven ability to organize audit strategies and compliance programs. Deep and strategic knowledge of Cyber Security Governance frameworks and the ability to implement enterprise-wide programs. Comprehensive understanding of Cybersecurity principles and advanced threat landscapes, including security architecture. Expert-level knowledge of Information Security principles and best practices, including incident response. Expert-level understanding of Risk Analysis methodologies and the ability to lead organizational risk assessment strategies.
• Bonus: Master’s degree preferred or equivalent practical experience.