Sr. Director, Governance, Risk & Compliance
Alnylam Pharmaceuticals
August 07, 2026
Remote friendly (Cambridge, MA)
United States
Corporate Functions
Responsibilities:
- Lead and evolve the enterprise GRC program.
- Define and execute a multi-year cyber risk and compliance maturity roadmap aligned to NIST CSF v2.0, ERM, regulatory requirements, and business priorities.
- Own the cyber risk management lifecycle (identify, assess, prioritize, treat) and executive-level reporting.
- Establish and maintain security governance frameworks, policies, standards, and exception management.
- Provide GxP cybersecurity governance and risk oversight (data integrity, validation expectations, IT SDLC, quality requirements across research/clinical/manufacturing/quality).
- Ensure policies/standards/risk decisions consider validated system constraints, change control, and inspection readiness.
- Oversee regulatory/compliance activities: HIPAA, SOX, FDA-adjacent biotech regulations, CSV, privacy requirements, and emerging regulations (e.g., NIS2).
- Lead audits/inspections/assurance; manage findings/remediation plans and reporting.
- Own and mature third-party risk management (TPRM).
- Embed cybersecurity risk into system lifecycle and validation; define/track risk-based metrics and KRIs.
- Build and lead a high-performing GRC organization; deliver executive/board reporting.
Qualifications:
- Bachelor’s degree (advanced degree preferred).
- 15+ years in cybersecurity, risk management, compliance, or audit.
- 10+ years leading GRC/risk/compliance teams.
- Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, and ERM frameworks.
- Experience in regulated biotech/pharma/healthcare/life sciences.
- Ability to translate complex risk for executive/board audiences.
- CISSP/CISM/CRISC/CISA strongly preferred.
- Proven influence across Security, IT, Legal, Audit, and business stakeholders.
Benefits:
- Medical, dental, and vision; life and disability insurance; lifestyle reimbursement; flexible spending/HSAs; 401(k) with company match; paid time off, wellness days, holidays, and two recharge breaks; family resources and leave.
- Lead and evolve the enterprise GRC program.
- Define and execute a multi-year cyber risk and compliance maturity roadmap aligned to NIST CSF v2.0, ERM, regulatory requirements, and business priorities.
- Own the cyber risk management lifecycle (identify, assess, prioritize, treat) and executive-level reporting.
- Establish and maintain security governance frameworks, policies, standards, and exception management.
- Provide GxP cybersecurity governance and risk oversight (data integrity, validation expectations, IT SDLC, quality requirements across research/clinical/manufacturing/quality).
- Ensure policies/standards/risk decisions consider validated system constraints, change control, and inspection readiness.
- Oversee regulatory/compliance activities: HIPAA, SOX, FDA-adjacent biotech regulations, CSV, privacy requirements, and emerging regulations (e.g., NIS2).
- Lead audits/inspections/assurance; manage findings/remediation plans and reporting.
- Own and mature third-party risk management (TPRM).
- Embed cybersecurity risk into system lifecycle and validation; define/track risk-based metrics and KRIs.
- Build and lead a high-performing GRC organization; deliver executive/board reporting.
Qualifications:
- Bachelor’s degree (advanced degree preferred).
- 15+ years in cybersecurity, risk management, compliance, or audit.
- 10+ years leading GRC/risk/compliance teams.
- Deep knowledge of NIST CSF, NIST 800-53, ISO 27001, and ERM frameworks.
- Experience in regulated biotech/pharma/healthcare/life sciences.
- Ability to translate complex risk for executive/board audiences.
- CISSP/CISM/CRISC/CISA strongly preferred.
- Proven influence across Security, IT, Legal, Audit, and business stakeholders.
Benefits:
- Medical, dental, and vision; life and disability insurance; lifestyle reimbursement; flexible spending/HSAs; 401(k) with company match; paid time off, wellness days, holidays, and two recharge breaks; family resources and leave.