Director of Governance, Risk, and Compliance / TPRM

Established in 2021,   Independence Pet Holdings   is a corporate holding company that manages a diverse and broad portfolio of modern pet health brands and services, including insurance, pet education, lost recovery services, and more throughout North America. We believe pet insurance is more than a financial product and build solutions to simplify the pet parenting journey and help improve the well-being of pets. As a leading authority in the pet category, we operate with a full stack of resources, capital, and services to support pet parents. Our multi-brand and omni-channel approach include our own insurance carrier, insurance brands and partner brands.  Director, Governance, Risk & Compliance (GRC) and Third- Party Risk Management (TPRM) Location: Chicago, IL (Hybrid) Reports To: Chief Information Security Officer (CISO) Position Overview The Senior Director of Governance, Risk & Compliance (GRC) and Third-Party Risk Management (TPRM) is an enterprise leadership role accountable for the design, implementation, and continuous maturation of a unified risk and compliance program across a $2.5 billion insurance holding company. This position holds end-to-end accountability for the information security compliance posture of an organization comprised of 12 Managing General Agencies (MGAs) and 2 insurance carriers, operating within a complex and highly regulated environment. Operating at the intersection of cybersecurity, regulatory compliance, and third-party governance, this leader serves as the central authority for aligning disparate control environments into a cohesive, measurable, and defensible enterprise risk framework. The role requires executive-level influence, regulatory fluency, and the ability to drive consistency across a federated, acquisition-driven operating model. Key Responsibilities Enterprise Accountability & Regulatory Posture • Own and maintain the enterprise-wide information security compliance posture across all operating entities, ensuring alignment with regulatory expectations and internal risk appetite. • Establish a defensible, evidence-driven control environment capable of withstanding regulatory scrutiny across multiple jurisdictions. • Serve as the authoritative leader for compliance strategy across MGAs and carrier entities with differing regulatory obligations. Enterprise GRC Strategy & Architecture • Design and implement a unified GRC operating model across multiple insurance entities with varying levels of maturity. • Establish a control-centric framework leveraging NIST 800-53, ISO 27001, SOC 2, and PCI DSS. • Transition the organization from periodic, interview-based assessments to continuous, evidence-driven compliance measurement. • Define and operationalize KRIs, control effectiveness metrics, and executive reporting. Regulatory & Audit Leadership • Serve as the central point of accountability for regulatory readiness, including NYDFS, state insurance regulators, and international frameworks where applicable. • Lead enterprise-wide audit strategy (SOC 2 Type II, ISO 27001, internal audits). • Interface directly with regulators and external auditors to ensure consistent narratives, defensible controls, and successful audit outcomes. • Drive enterprise remediation strategies with measurable timelines and executive accountability. Third-Party Risk Management (TPRM) • Build and scale a comprehensive TPRM program across the full vendor lifecycle. • Establish risk tiering, due diligence, and continuous monitoring aligned with enterprise risk tolerance. • Integrate TPRM into procurement, legal, and business operations to ensure consistent enforcement. • Oversee risk acceptance and exception governance frameworks. Operational Integration & Transformation • Harmonize fragmented GRC practices across acquired entities into a centralized and scalable function. • Drive automation strategy leveraging GRC platforms (auditboard, Drata, or equivalent) to enable real-time compliance visibility and evidence collection. • Embed security, privacy, and identity governance into enterprise-wide control frameworks. • Advance organizational maturity toward a “Security First” operating model. Executive Engagement & Cross-Functional Collaboration • Provide regular reporting to executive leadership and board-level stakeholders (e.g., Audit Committee, Risk Committee). • Collaborate daily with the Chief Privacy Officer (CPO) and Chief Risk Officer (CRO) organizations to ensure alignment across privacy, enterprise risk management, and information security compliance. • Translate complex regulatory and technical requirements into business-aligned decision frameworks. • Influence enterprise investment decisions through quantified risk exposure and control effectiveness. Leadership & Organizational Complexity • Lead a multi-layered global GRC and TPRM organization, including: o 4 senior GRC functional leaders o A transversal offshore operations team o A dedicated outsourced delivery pod (India-based) supporting scaled compliance and assessment activities • Establish governance models, performance management, and operational rigor across distributed teams. • Drive talent strategy, succession planning, and capability development aligned to enterprise scale. Qualifications Experience • 12–15+ years of progressive experience in cybersecurity, risk management, compliance, or audit. • 5–7+ years in senior leadership roles within insurance or highly regulated financial services environments (required). • Proven success leading enterprise GRC and TPRM programs across complex, multi-entity organizations. Professional Background • Licensed attorney (JD) or Certified Public Accountant (CPA) strongly preferred, particularly with experience in regulatory interpretation, audit, or assurance. • Background in external audit, internal audit, or regulatory advisory highly desirable. • MBA or equivalent advanced business de