Governance, Risk & Compliance Manager

Summary:

VIAVI (NASDAQ: VIAV) is a global provider of network test, monitoring and assurance solutions for telecommunications, cloud, enterprises, first responders, military, aerospace, and railway. VIAVI is also a leader in light management technologies for 3D sensing, anti-counterfeiting, consumer electronics, industrial, automotive, government and aerospace applications.

We are the people behind the products that help keep the world connected at home, school, work, at play, and everywhere in between. VIAVI employees are passionate about supporting customer success and we welcome people who bring their best every day to the company – to question, to collaborate and to push for solutions that will delight our customers.

Duties & Responsibilities:

Position Summary

VIAVI Solutions is seeking a Manager, Governance, Risk & Compliance (GRC) to lead and mature the company's information security governance, cybersecurity risk, compliance and assurance capabilities.

This is a player-coach role with a strong hands-on expectation. The successful candidate will provide leadership for the GRC function while remaining directly involved in risk assessments, policy development, control assessments, audit preparation, compliance activities, evidence reviews and remediation.

The Manager will have key responsibility for VIAVI's ISO 27001, CMMC and AI Governance programs and will partner across Security Engineering, Cyber Defense, Product Security, IT, Legal, Privacy, Internal Audit and business teams.

The role will help establish a scalable, risk-based governance model that translates regulatory, contractual and business requirements into clear security expectations, accountable ownership and measurable outcomes.

Key Responsibilities

Information Security Governance

• •Develop, maintain and continuously improve the enterprise information security governance framework.
• •Develop and maintain security policies, standards, procedures and supporting governance documentation.
• •Establish clear security-control ownership and accountability across the organization.
• •Maintain security exception, risk-acceptance and waiver processes.
• •Translate regulatory, contractual and business requirements into practical security requirements.
• •Promote consistent and sustainable security practices across the organization.

Cybersecurity Risk Management

• •Develop and operate cybersecurity risk-management processes and methodologies.
• •Lead risk assessments for significant technologies, business initiatives, third parties and changes to the technology environment.
• •Maintain visibility into significant cybersecurity risks, owners, treatment plans, exceptions and residual risks.
• •Facilitate risk-treatment and risk-acceptance decisions with business and technology stakeholders.
• •Develop meaningful cybersecurity risk reporting for security leadership and executive stakeholders.

ISO 27001 & CMMC

• •Lead the ongoing management and continuous improvement of VIAVI's Information Security Management System (ISMS).
• •Coordinate ISO 27001 risk assessments, control reviews, internal assessments, corrective actions and certification/surveillance readiness.
• •Lead GRC activities supporting CMMC readiness and ongoing compliance.
• •Coordinate CMMC scoping, control ownership, documentation, evidence and assessment preparation.
• •Partner with technical and business control owners to identify and remediate security-control gaps.
• •Establish sustainable evidence-management and control-validation practices.

AI Governance

• •Develop and mature VIAVI's enterprise AI governance and risk-management framework.
• •Establish governance requirements for the responsible and secure adoption of AI technologies.
• •Develop an AI risk-tiering approach considering factors such as data sensitivity, autonomy, technology risk and business impact.
• •Establish governance processes for assessing and approving AI tools, applications and use cases.
• •Define AI-related exception and risk-acceptance processes.
• •Establish appropriate governance expectations for sensitive-data use and human oversight of higher-risk AI applications.
• •Partner with Security Engineering to translate AI governance requirements into technical controls and guardrails.
• •Partner with Legal, Privacy, Procurement, IT and business stakeholders on AI-related risk and governance requirements.
• •Monitor relevant AI standards and regulatory developments and incorporate applicable requirements into VIAVI's governance program.
• •Support alignment, as appropriate, with frameworks such as NIST AI RMF and ISO/IEC 42001.

Compliance, Assurance & Leadership

• •Coordinate cybersecurity-related internal and external assessments and audits.
• •Evaluate control implementation and supporting evidence against defined requirements.
• •Coordinate remediation with control owners and monitor significant security and compliance gaps.
• •Partner with Legal, Privacy, Internal Audit, Security and technology teams on overlapping regulatory and assurance requirements.
• •Support customer or third-party cybersecurity assurance activities as appropriate.
• •Operate as a player-coach, personally performing critical GRC work while developing the broader capability.
• •Mentor team members and establish repeatable, sustainable GRC processes rather than point-in-time compliance activities.

Pre-Requisites / Skills / Experience Requirements:

Required Qualifications

• •10+ years of progressive experience in cybersecurity, information security governance, risk management, compliance, audit or security assurance.
• •Significant hands-on experience with cybersecurity governance and risk-management activities.
• •Demonstrated experience leading or materially contributing to major cybersecurity compliance, audit or assurance programs.
• •Experience developing policies, performing risk assessments, evaluating controls, reviewing evidence and managing remediation.
• •Strong understanding of common cybersecurity frameworks and control concepts.
• •Experience translating regulatory, contractual and risk requirements into practical control requirements.
• •Experience working collaboratively across technical, Legal, Privacy, Audit and business stakeholders.
• •Strong written and verbal communication skills, including the ability to communicate cybersecurity risk to leadership.
• •Demonstrated leadership, stakeholder-management and mentoring capabilities.
• •Experience with AI governance, AI risk management or emerging technology governance.
• •Experience with implementing and maintaining tools like Vanta, Drata, Sprinto etc.
• •Familiarity with Third-Party Vendor Risk Management processes
• •Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
• •Familiarity with managing Security Awareness Program including tools like KnowBe4, Adaptive Security etc.

Preferred Qualifications

• •Experience leading or operating an ISO 27001 ISMS.
• •Experience with CMMC and/or NIST SP 800-171.
• •Experience with cybersecurity regulatory or customer assurance requirements.
• •Experience with AI governance, AI risk management or emerging technology governance.
• •Experience with implementing and maintaining tools like Vanta, Drata, Sprinto etc.
• •Familiarity with Third-Party Vendor Risk Management processes
• •Familiarity with UK Cyber Essentials, EU-CRA, PCI DSS and SOC 2.
• •Familiarity with NIST AI RMF, ISO/IEC 42001 or similar AI governance frameworks.
• •Familiarity with managing Security Awareness Program including tools like KnowBe4, Adaptive Security etc.
• •Relevant certifications such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Lead Auditor or comparable credentials.
• •Previous people-management or GRC team-leadership experience.
• •This position requires use of information which is subject to the International Traffic in Arms Regulations (ITAR). All applicants must be U.S. Persons within the meaning of ITAR. ITAR defines a U.S. Person as a U.S. Citizen or National, U.S. Lawful Permanent Resident (i.