SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Despegar is seeking a GRC Manager to lead governance, risk, and compliance initiatives with a modern, technology-forward approach.
Key Responsibilities:
**Innovation & AI Adoption**: Lead the redefinition of GRC methodologies using automation and intelligent agents for repetitive workflows (e.g., vendor questionnaires, control mapping). Prioritize adoption and friction reduction for non-technical teams over tool complexity.
**Regulatory Governance (Docs-as-Code)**: Maintain and evolve the policy and procedures framework. Drive modern document management using Git repositories, code reviews (PR-as-approval), and rendered frontends to ensure regulatory traceability and version control.
**Data Protection & AI Governance**: Define technical and organizational measures to protect sensitive data and collaborate closely with the DPO. Integrate early AI governance practices, ensuring clear data-handling policies before deploying new agents or tools.
**Audit & Risk Management**: Serve as focal point for third-party assessments. Orchestrate a progressive automation roadmap, from low-risk tasks to intensive litigation support (gap analysis, risk registers).
**Regulatory Alignment & Metrics**: Design KPI/KRI dashboards for the Executive Committee. Maintain control framework traceability to classical regulations (PCI, SOX) and emerging frameworks (DORA, NIS2, EU AI Act, CSRD).
Requirements:
- University degree in Cybersecurity, Engineering, Computer Science, Administration, Technology Law, or related fields. Systemic mindset valued over specific title.
- Proven leadership experience in GRC, Data Protection, and/or PCI roles (required).
- Strong interest and practical experience applying AI to business. Demonstrable ability to interact with LLMs (prompt engineering), conceptualize agent workflows, and understand AI tool limitations and necessary controls.
- Knowledge of privacy regulations (e.g., GDPR) and familiarity with ISO/IEC 27001, NIST, CIS Controls, COBIT. Knowledge of AI risk frameworks (e.g., NIST AI RMF) valued.
- Excellent negotiation skills, strategic vision, and ability to translate technical requirements into digestible business language for non-technical teams.
- CISM, CRISC, CISA, or CISSP certifications valued. Advanced English proficiency required.
