Senior Manager Cybersecurity Governance & Assurance

Why Join GEICO?

At GEICO, we offer a rewarding career where your ambitions are met with endless possibilities.

Every day we honor our iconic brand by offering quality coverage to millions of customers and being there when they need us most. We thrive on relentless innovation to exceed our customers' expectations while making a real impact on local communities nationwide.

Founded in 1936, GEICO is a member of the Berkshire Hathaway family of companies and one of the largest auto insurers in the United States. When you join our company, we want you to feel valued, supported, and proud to work here. That's why we offer the GEICO Pledge: Great Company, Great Culture, Great Rewards, and Great Careers.

The Senior Manager of Cyber Governance & Assurance will lead and mature the enterprise cybersecurity governance program, establishing an effective operating model for policies, standards, control governance, cyber risk management and cyber assurance.  This leader will partner with Cybersecurity, Technology, Legal, Privacy, Enterprise Risk and Internal Audit to translate regulatory and security requirements into actional controls, drive clear accountability and provide leadership with measurable visibility into compliance posture, control effectiveness and cyber risk.  The successful candidate will combine strategic judgment, technical credibility and strong people leadership to influence decision across organizational boundaries and continuously improve how cybersecurity governance operates.

Key Responsibilities

- Own and mature the Cyber Governance operating model, including governance forums, establishing clear decision rights, roles and responsibilities, accountability and escalation paths across Cybersecurity and Tech.

- Advise senior leaders on cybersecurity governance, regulatory obligations and material cyber risk; present clear option, recommendations and decisions required.

- Lead the cybersecurity policy, standard and control lifecycle from development, and stakeholder review through approval, publication and periodic refresh.
- Translate regulatory and cybersecurity requirements into actionable technology standards, controls and engineering requirements.
- Ensure cyber security exceptions and acceptances do not introduce aggregated risk and address root cause of cyber systemic exceptions.
- Identify systemic control failures to identify root causes and partner with accountable owners to drive enterprise level remediation.
- Establish governance for the cybersecurity controls, including ownership, design expectations, evidence requirements, effectiveness monitoring, deficiencies and remediation oversight, hold implementation owners accountable.
- Drive control rationalization and harmonization across regulatory frameworks to reduce duplicative controls and create a common enterprise control framework.
- Partner with Technology and Engineering teams to embed compliance requirements and automated controls into engineering workflows and the software development cycle.
- Define cybersecurity governance KPIs, KRIs and compliance metrics covering compliance posture, control health, remediation progress and emerging risks.
- Lead the development and delivery of monthly and quarterly business reviews, translating cybersecurity governance performance, compliance posture, emerging risks and strategic initiatives into executive-level insights, recommendations and actionable decisions.
- Partner with Enterprise Risk and accountable risk owners to maintain accurate cyber risk records, escalation material exposure and oversee treatment commitments.
- Set governance requirements and priorities for continuous compliance monitoring and automation across multi-cloud and data center environments, partner with engineering teams responsible for delivery.
- Manage all cyber issues to closure.
- Build, mentor and lead a high-performing governance function, with clear priorities, ownership, coaching, while fostering a culture of accountability, innovation and continuous improvement.
- Lead monthly, quarterly annual priorities, resource planning, change adoption and performance management; establish an inclusive, accountable team culture and develop team members.
- Influence cross-functional stakeholders, constructively challenge proposed risk decisions and lead complex discussions to resolution without relying on direct authority.

What you will need

- Deep expertise in cybersecurity governance, control frameworks, risk management and regulatory compliance, with the ability to connect requirements to technical implementation.
- Demonstrated experience presenting to senior leadership, effectively communication performance, risks and strategic priorities while confidently addressing challenging questions and driving executive alignment.
- Demonstrated credibility with senior leaders, translates complex cyber and regulatory matters into business implications, presents clear options and facilitates decision.
- Exceptional written and verbal communication, including the ability to lead difficult, high-stakes discussions, challenge constructively and gain alignment without direct authority.
- Sound judgement and accountability in ambiguous environments, balancing regulatory obligations, business priorities and risk.
- Experience leading and developing technical governance, compliance or security engineering professionals, including performance management and coaching.
- Proven delivery of enterprise scale governance transformation, cross functional change and measurable process improvement.
- Working technical knowledge of multi-cloud and hybrid/data center security controls: MS Azure and AWS experience preferred.

Qualifications

- 7+ years of progressive experience in cybersecurity governance, risk and compliance, including at least 5 years leading teams and enterprise programs.
- Experience establishing or maturing governance and compliance capabilities in large, complex, multi-cloud and hybrid environments.
- Strong working knowledge of application security frameworks and standards such as ISO 27001, NIST 800-series, NY DFS, CPPA/CPRA, PCI DSS, NIST CSF, SOX is valuable as applicable to assigned scope.
- Experience overseeing cybersecurity audits or regulatory examinations and coordinating control remediation with accountable owners.
- Experience with strategic planning, program roadmaps, priorities and resource allocation
- Bachelor’s degree in a related field or equivalent professional experience.  CISSP, CISM, CISA or CRISC preferred.

Annual Salary
$120,000.00 - $260,000.00
The above annual salary range is a general guideline. Multiple factors are taken into consideration to arrive at the final hourly rate/ annual salary to be offered to the selected candidate. Factors include, but are not limited to, the scope and responsibilities of the role, the selected candidate’s work experience, education and training, the work location as well as market and business considerations.

GEICO will consider sponsoring a new qualified applicant for employment authorization for this position.

The GEICO Pledge:

Great Company:  Protecting customers through life’s twists and turns with innovation and integrity.

Great Careers:   Personalized development programs, mentorship, and certification assistance.

Great Culture:   Inclusive and collaborative culture rooted in shared success.

Great Rewards:   Competitive pay, benefits, and flexibility to support your well-being and future.

The equal employment opportunity policy of the GEICO Companies provides for a fair and equal employment opportunity for all associates and job applicants regardless of race, color, religious creed, national origin, ancestry, age, gender, pregnancy, sexual orientation, gender identity, marital status, familial status, disability or genetic information, in compliance with applicable federal, state and local law. GEICO hires and promotes individuals solely on the basis of their qualifications for the job to be filled.

GEICO reasonably accommodates qualified individuals with disabilities to enable them to receive equal employment opportunity and/or perform the essential functions of the job, unless the accommodation would impose an undue hardship to the Company. This applies to all applicants and associates. GEICO also provides a work environment in which each associate is able to be productive and work to the best of their ability. We do not condone or tolerate an atmosphere of intimidation or harassment. We expect and require the cooperation of all associates in maintaining an atmosphere free from discrimination and harassment with mutual respect by and for all associates and applicants.