Companies in this catalog do not charge applicants. Never send money to apply.
The Lead Information Security Auditor (GRC) is a senior cybersecurity and risk management leader responsible for establishing, maintaining, and continuously improving the organization's cybersecurity governance, risk, and compliance program across product development, manufacturing, operational technology (OT), and enterprise IT environments.
This role ensures the organization effectively manages cyber risk, complies with applicable regulatory and industry requirements, and maintains governance processes that protect intellectual property, patient safety, operational resilience, and business objectives. The position serves as a key liaison between cybersecurity, business leadership, quality and regulatory affairs, legal, audit, and external regulators to ensure security requirements are embedded throughout the organization's operations and product lifecycle.
This role plays a critical part in enabling secure innovation, supporting regulatory readiness, managing enterprise cyber risk, and providing executive visibility into cybersecurity posture and compliance performance.
Key Responsibilities:
Cybersecurity Governance
Lead the development, implementation, and maintenance of cybersecurity policies, standards, procedures, and governance frameworks.
Establish governance processes that align cybersecurity initiatives with business objectives and regulatory requirements.
Maintain cybersecurity framework alignment with NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and applicable industry regulations.
Develop and present cybersecurity metrics, KPIs, KRIs, and risk dashboards to executive leadership.
Facilitate cybersecurity steering committees and governance forums with senior stakeholders.
Track remediation activities and ensure accountability for risk mitigation activities.
Enterprise Risk Management
Lead enterprise-wide cybersecurity risk assessment and risk management programs.
Establish and maintain a cyber risk register covering enterprise IT, manufacturing systems, cloud services, and connected medical devices.
Evaluate risks related to patient safety, operational resilience, intellectual property protection, regulatory exposure, and business continuity.
Perform risk assessments for new technologies, business initiatives, mergers, acquisitions, and strategic projects.
Develop risk treatment plans and monitor mitigation efforts through completion.
Translate technical security risks into business impact statements for executive leadership.
Regulatory Compliance & Audit Management
Lead cybersecurity compliance efforts supporting SOX, ISO 27001, NIST, GDPR, NIS2, and applicable healthcare and manufacturing requirements.
Drive remediation and risk acceptance processes for identified supplier risks.
Product Security Governance
Partner with Engineering, Product Development, Quality, and Regulatory Affairs teams to ensure cybersecurity requirements are incorporated throughout the product lifecycle.
Oversee cybersecurity risk assessments for medical and surgical devices.
Support secure development governance processes and cybersecurity documentation requirements.
Ensure compliance with applicable device cybersecurity guidance and regulatory expectations.
Facilitate coordinated vulnerability disclosure governance and vulnerability management oversight.
Security Awareness & Compliance Culture
Lead enterprise cybersecurity awareness, education, and compliance initiatives.
Promote a culture of security accountability and risk ownership throughout the organization.
Develop targeted awareness programs for executives, manufacturing personnel, engineers, and business teams.
Support phishing awareness, policy compliance, and security training programs.
Measure and report on program effectiveness and compliance trends.
Business Continuity & Resilience Governance
Partner with business continuity and disaster recovery stakeholders to ensure cyber resilience requirements are addressed.
Support business impact analyses and resilience planning activities.
Participate in tabletop exercises and cyber crisis management planning.
Evaluate recovery capabilities and resilience controls for critical business processes and manufacturing operations.
Monitor remediation actions resulting from exercises and resilience assessments.
Leadership & Stakeholder Management
Provide leadership and direction for cybersecurity governance, risk, and compliance initiatives.
Mentor cybersecurity professionals on risk management, compliance frameworks, and governance best practices.
Serve as the primary cybersecurity liaison for Audit, Compliance, Legal, Quality, and Regulatory Affairs functions.
Present risk and compliance updates to executive leadership, committees, and external stakeholders.
Support strategic cybersecurity planning and roadmap development.
Job Requirements
Bachelor's degree in Cybersecurity, Information Technology, Business, Engineering, Risk Management, or related field (or equivalent experience).
7+ years of experience in cybersecurity, information security governance, risk management, compliance, audit, or related disciplines.
Preferred Experience
Experience developing and managing cybersecurity governance, risk, and compliance programs.
Experience conducting risk assessments and managing enterprise risk registers.
Experience supporting internal audits, external audits, and regulatory examinations.
Strong understanding of cybersecurity frameworks and regulatory requirements.
Experience in healthcare, medical device manufacturing, life sciences, or regulated industries.
Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, SOX, GDPR, NIS2, and third-party risk management practices.
Experience managing enterprise GRC platforms such as ServiceNow GRC, Archer, OneTrust, or AuditBoard.
Experience developing executive risk reporting, metrics, and board-level presentations.
Familiarity with medical device cybersecurity regulations and product security risk management.
Professional certifications preferred:
CISSP
CRISC
CISM
CGRC (formerly CAP)
CISA (Preferred)
ISO 27001 Lead Implementer or Lead Auditor
This position is not eligible for employer-visa sponsorship
Disclosure as required by applicable law, the annual salary range for this position is $104,134 - $163,640. The actual compensation may vary based on geographic location, work experience, education and skill level. The salary range is CONMED ’s good faith belief at the time of this posting.
This job posting is anticipated to close on November 8, 2026. We may, however, extend this time period, in which case the posting will remain available on careers.conmed.com. Please submit your application as soon as possible as we will be reviewing applications on a rolling basis as we receive them.
Benefits:
CONMED offers a wide array of benefits to fit your unique needs. Visit our Benefits Page for more information.
Competitive compensation Excellent healthcare including medical, dental, vision and prescription coverage Short & long term disability plus life insurance -- cost paid fully by CONMED Retirement Savings Plan (401K) -- CONMED matches your contributions dollar for dollar, with the potential for up to 7% per pay period Employee Stock Purchase Plan -- allows stock purchases at discounted price Tuition assistance for undergraduate and graduate level courses Know someone at CONMED ? Have them submit you as a referral before applying for this position to be eligible for our Employee Referral Program incentives!
CONMED is an equal opportunity employer and does not discriminate on the basis of any legally protected status or characteristic. Protected veterans and individuals with disabilities are encouraged to apply. The Know Your Rights: Workplace Discrimination is Illegal Poster reaffirms this commitment.
Colorado Residents: In any materials you submit, you may redact or remove age-identifying information such as age, date of birth, or dates of school attendance or graduation. You will not be penalized for redacting or removing this information.
If you feel you need a reasonable accommodation pursuant to the ADA, you are encouraged to contact us at 800-929-7176 option #5.
