Program Manager

Summary

Join Redwood Materials as a Staff Program Manager, Information Security, and lead the preparation and ongoing audit readiness of the Information Security program. Collaborate with IT, Enterprise Risk and Compliance, and Quality Assurance teams to drive the maturity of the Information Security Compliance Program. Design and execute the strategic vision for the Information Security GRC program, developing and maintaining policies, procedures, and organizational capabilities. Identify and prioritize opportunities for improving organizational risk posture, and create and maintain comprehensive Information Security documentation. Serve as a subject matter expert in various areas of Information Security, including compliance program management, audit evidence gathering, and risk assessments. Own and maintain third-party risk management evaluation practices and manage operational capabilities, including GRC tools and platforms. Represent Information Security in partnerships with internal teams and third-party organizations. Establish and own the Information Security change management review process.

Requirements

• 7+ years of hands-on experience in Information Security Governance, Risk, and Compliance programs developing risk-centric solutions, leveraging industry standard controls frameworks and implementations
• 5+ years of direct ownership in at least 3 of the following: Compliance Program Management
• Audit Evidence Gathering
• User Access Reviews
• Policy and Process Development
• Change Management
• Risk Assessment and Mitigation
• Security Awareness and Training Programs
• Proficiency with 4 or more industry-standard compliance programs (e.g., ISO 27001, CISv8.1, NIST 800-53/88/171, CMMC, TISAX, SOC 2, Sarbanes-Oxley)
• Extensive experience overseeing IT compliance initiatives in mixed on-premises and cloud-based environments (e.g., AWS, GCP, Azure, Entra, Active Directory etc ), ensuring adherence to industry standards and regulatory requirements
• Advanced knowledge of Governance, Risk, and Compliance frameworks and best practices, demonstrable experience in: Developing and implementing IT security policies and procedures
• Conducting risk assessments and managing risk mitigation initiatives
• Preparing for and managing internal and external IT audits
• Leading security awareness and training programs
• Third Party Risk Management Evaluations
• Strong understanding of regulatory requirements and industry standards
• Familiarity with GRC tools and technologies
• Relevant professional certifications such as PMP, CISSP, CIPM, CIPT, CISM, CISA, CRISC, CGEIT, GSEC, GSNA or GCCC
• Excellent communication and interpersonal skills, including: Ability to influence and collaborate with stakeholders at all levels
• Strong presentation and report-writing skills
• Effective leadership and mentoring abilities
• Demonstrated experience in managing complex programs and projects, including developing project plans, and leading cross-functional teams to deliver results on time and within scope
• Excellent attitude, team collaboration, communication, and self-motivation
• A passion for sustainability and making the world a better place!
• Ability to perform essential job functions in compliance with ADA, FMLA, and other relevant federal, state, and local regulations, including meeting both qualitative and quantitative productivity standards
• Ability to maintain regular and punctual attendance in line with ADA, FMLA, and applicable standards
• Ability to wear personal protective equipment (PPE), including safety gloves, helmets, and eyewear, or additional PPE when required
• Ability to lift and carry up to 50 lbs
• Ability to communicate clearly and effectively on the telephone, including listening and speaking

Responsibilities

• Design and execute the strategic vision for our Information Security GRC program
• Develop and maintain the Information Security Governance, Risk, and Compliance program, creating policies, procedures, and extending organizational capabilities while ensuring alignment with industry best practices
• Drive cross-functional collaboration with IT, Enterprise Risk and Compliance, and other operational teams to implement secure, consistent patterns and expand observability
• Identify and prioritize opportunities for improving organizational risk posture
• Create and maintain comprehensive Information Security documentation, including a knowledge base, compliance reports, risk registers, and policy documentation
• Serve as a subject matter expert in: Developing and managing the Compliance Program
• Coordinating Audit Evidence Gathering
• Overseeing User Access Reviews
• Developing Policies and Processes
• Managing Change Management Processes
• Conducting Risk Assessments and Mitigation
• Leading Security Awareness and Training Programs
• Own and maintain Third Party Risk Management evaluation practices
• Maintain the Information Security policy portfolio
• Manage operational capabilities including GRC tools and platforms
• Oversee the security lifecycle of compliance initiatives and audit preparations
• Represent Information Security in partnerships with internal teams and third-party organizations
• Develop and maintain a reporting framework to keep stakeholders informed of risks, compliance status, and program progress
• Establish and own the Information Security change management review process