Are you passionate about strengthening technology risk and compliance while helping a business move forward with confidence? Join our Enterprise Technology organization and help shape how we manage cybersecurity risk, strengthen compliance, and build resilient technology practices across the enterprise. This position is in Richmond, VA with a hybrid work schedule. Relocation benefits will be provided.

As Manager, Risk, Compliance and Governance, you’ll serve on the cybersecurity team, coordinating closely with Business Information Security Officers, IT Risk Management, Corporate Audit, and technology control owners. You’ll play a substantial role in advancing IT compliance strategies. You will support SOX and other regulatory controls. You will strengthen oversight of disaster recovery processes and help ensure our technology environment meets evolving security and compliance expectations.

What you will be doing:

• Partnering with control owners to build, update, and implement controls across applicable domains, including AI, PII, SOX, PCI, and HIPAA.
• Assessing compliance frameworks and strategies to align digital risk management and regulatory oversight practices with the company’s business strategy.
• Establishing and maintaining disaster recovery governance, including the completeness and accuracy of disaster recovery plans, procedures, and supporting documentation.
• Validating business impact assessments for applications across the Altria environment and supporting technology resiliency and disaster recovery preparedness.
• Conducting technical control, compliance, and resiliency assessments to evaluate the effectiveness of controls designed to protect systems and data.
• Building and leading all aspects of compliance and control metrics, dashboards, standards, patterns, and guidelines that support portfolio delivery and provide significant insights to senior leaders.
• Partnering with Corporate Audit and audit liaison functions to support remediation of internal and external audit management action plans and minimize findings.

We want you to have:

• Bachelor’s degree in an IT-related field or equivalent relevant experience.
• 8+ years of information technology experience specializing in security control selection and validation, security assessments, system accreditation, auditing, or technology architecture.
• Demonstrated proficiency with current IT technologies and their application within security, risk, and compliance environments.
• Hands-on knowledge of NIST 800-series guidelines, including the Developing Cyber-Resilient Systems (NIST SP 800-160) and NIST Cyber Security Framework 2.0.
• Experience with Plan of Action and Milestones (POA&M), vulnerability and patch management, and risk management.
• Knowledge of industry-specific compliance standards, including Sarbanes-Oxley (SOX), SEC, HIPAA, and PCI DSS requirements, as they relate to information systems and associated control testing.