Senior Cyber GRC Specialist

Why Mobility Global? At Mobility Global, our mission is to provide trusted information that helps billions of people build, sell, and own vehicles with confidence. As we shape the next generation of automotive intelligence through innovation, AI, and industry-leading data, we're creating new opportunities for our customers, our business, and our people. Role Summary  The Senior Cyber GRC Specialist is an individual contributor responsible for assessing and managing cybersecurity risks arising from third-party relationships and deviations from approved security policies and standards. The role serves as a technical risk advisor across Security, Technology, Procurement, Legal, Privacy, and business teams.  This position requires practical cybersecurity knowledge to review technical controls, ask appropriate follow-up questions, challenge incomplete or unsupported responses, evaluate compensating controls, and translate technical risk into clear business impact. The role assesses risk and provides recommendations; formal risk acceptance remains with the authorized business and security approvers. Key Responsibilities  Perform risk-based cybersecurity assessments of vendors, suppliers, SaaS providers, cloud service providers, and other third parties during onboarding, reassessment, renewal, and material service changes.  Review security questionnaires, independent assurance reports, certifications, penetration test summaries, architecture information, vulnerability management practices, incident response capabilities, and other relevant security evidence.  Engage vendor and internal technical teams to clarify security architecture, control design, identified gaps, remediation commitments, and residual risk.  Identify and document third-party cyber risks, determine risk severity, recommend risk treatment, and track agreed remediation actions through closure.  Apply assessment depth based on service criticality, data sensitivity, connectivity, hosting model, regulatory exposure, and potential business impact.  Administer the security exception management lifecycle, including intake, completeness review, risk assessment, routing, approval coordination, expiration, renewal, closure, and reporting.  Evaluate exception requests against applicable security policies and standards, including the business justification, scope, duration, technical exposure, compensating controls, remediation plan, and residual risk.  Challenge exception submissions when risks are not adequately understood, supporting evidence is insufficient, or proposed compensating controls do not reasonably reduce exposure.  Partner with Security Architecture, Cloud Security, Application Security, Infrastructure, Identity and Access Management, Vulnerability Management, and other subject matter experts when specialized validation is required.