Director, Governance

About Riot Platforms Riot’s (NASDAQ: RIOT) vision is to be the world’s most trusted platform for powering and building digital infrastructure. Riot’s mission is to empower the future of digital infrastructure by positively impacting the sectors, networks, and communities that we touch. We believe that the combination of an innovative spirit and strong community partnership allows us to achieve best-in-class execution and create successful outcomes. Who we are At Riot, we’re building the future of digital infrastructure. Our team members have unparalleled opportunities to work on groundbreaking initiatives. Through technical excellence and strategic execution, Riot has positioned itself as a leader in the industry driving advancements that continue to set new benchmarks in digital infrastructure. We are trailblazers. Problem solvers. People who thrive in fast paced environments, communicate clearly, and bring relentless focus to efficiency and execution. About the role The Director, Governance owns the foundational infrastructure every other GRC pillar depends on. Without a policy library, Compliance has nothing to test. Without regulatory horizon scanning, risk finds Riot before Riot finds risk. Without a contracts management program, vendor and third-party risk runs unchecked. Governance is the bedrock of this program — and this role builds it from near zero in Year 1. This pillar is intentionally scoped to govern, not to test or audit. Governance owns the full lifecycle of policies and standards: drafting, approval routing, versioning, publication, and attestation tracking. Governance owns the ISO 27001:2022 documentation framework — all mandatory policy and procedure documents required for certification. Governance owns the regulatory radar, the Contracts Management program (in co-ownership with Legal), and the Third-Party Risk Management program (in partnership with Procurement). You will report to the Senior Director, GRC and maintain a co-ownership relationship with the Chief Legal Officer on Contracts Management, where Legal holds final sign-off authority at every material decision gate. In critical operations, you will engage mining site and data center leadership to ensure site-level operational policies, physical security standards, and environmental procedures are captured within the enterprise governance framework. What you'll do Build and own the ISO 27001:2022 documentation framework: identify and produce all mandatory policies, procedures, and records required for certification, map them to Annex A controls, and drive adoption through executive sponsorship and attestation programs — this is the Year 1 priority with a contractually fixed delivery timeline. Build and operate the Riot policy and standards library from near-zero baseline: establish the governance model (drafting, review routing, approval gates, versioning, renewal cadences), and extend scope beyond ISO 27001 to cover SOC 2, SOX, and enterprise policy requirements. Own the regulatory horizon scanning program: monitor developments across critical infrastructure, digital assets, data privacy, and financial services; translate regulatory signals into GRC program actions; and deliver regular briefings to the Sr. Director and executive leadership. Stand up the Contracts Management program in co-ownership with Legal: design the intake-to-repository workflow, establish GRC risk flagging criteria (data processing, liability, security, regulatory), and implement the Legal sign-off gate — Legal approves, GRC operates. Own the Third-Party Risk Management (TPRM) and vendor risk program: build the vendor tiering model, define due diligence requirements by tier, partner with Procurement on intake integration, and establish ongoing monitoring cadences for critical and colocation vendors. Manage the GRC framework lifecycle: maintain Riot's mapping of policies and controls to SOC 2 Trust Services Criteria, ISO 27001, NI…

View the full posting and apply