Sr GRC & Compliance Manager (CST & EST considered)

Accountabilities

• Lead the day-to-day execution of security, risk, compliance, and AI governance programs across the organization.

• Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS, ensuring applicable requirements are mapped to relevant controls and business processes.

• Prioritize and coordinate the current PCI-DSS audit cycle, including scope definition, control ownership, evidence collection, readiness assessments, remediation, auditor requests, fieldwork, and report completion.

• Establish and develop an AI Governance program, defining appropriate controls, accountability, documentation, and risk management processes.

• Maintain a consolidated mapping of audit requirements and controls across applicable business units, systems, and reports.

• Assign and monitor control ownership across technology, security, HR, finance, legal, and other relevant stakeholder groups.

• Coordinate with control owners to collect, review, organize, and validate audit evidence before submission, ensuring documentation demonstrates that controls are operating as intended.

• Manage communications with external auditors, including evidence requests, sample submissions, follow-up questions, status updates, and issue resolution.

• Identify control deficiencies, evidence gaps, exceptions, dependencies, and risks, then drive remediation plans with accountable owners, deadlines, and escalation paths.

• Maintain a centralized risk register and evidence-tracking process that provides clear visibility into open items, due dates, ownership, and progress.

• Develop and maintain compliance policies, standards, control narratives, system descriptions, and other governance documentation.

• Establish an annual compliance calendar and recurring control testing and evidence-validation procedures to improve audit readiness throughout the year.

• Provide regular reporting to security and technology leadership on audit status, control effectiveness, risks, blockers, remediation progress, and decisions requiring attention.

• Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to strengthen control maturity, improve accountability, and address evolving regulatory, customer, and security requirements.

• Following the PCI-DSS audit, implement a repeatable year-round compliance operating model that supports future audit cycles and continuous improvement.

Requirements

• At least five years of professional experience in information security governance, risk management, compliance, auditing, or a closely related discipline.

• Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection and validation, auditor coordination, and remediation tracking.

• Strong understanding of security and IT controls covering identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance.

• Demonstrated ability to coordinate compliance activities across technical teams and business functions, establish clear control ownership, and maintain stakeholder accountability.

• Strong evidence-review skills, including the ability to assess whether supporting documentation adequately demonstrates that a control operated as expected.

• Proven project and program management capabilities, with experience managing deadlines, dependencies, competing priorities, remediation activities, and escalations.

• Excellent written and verbal communication skills, including the ability to explain technical audit findings, compliance risks, and remediation needs to both technical teams and executive leadership.

• Strong organizational skills and attention to detail, with the ability to maintain structured documentation, track numerous open items, and provide reliable status reporting.

• Preferred: Experience managing enterprise compliance programs across multiple entities, departments, or business units.

• Preferred: Familiarity with GRC or audit management platforms and structured evidence repositories.

• Preferred: Knowledge of complementary security frameworks and standards, including NIST Cybersecurity Framework (NIST CSF), CIS Controls, and ISO 27001.

• Preferred: Relevant professional certifications such as CISA, CISM, CRISC, CISSP, or equivalent practical experience.

• Ability to work effectively in a remote environment, primarily using a computer for extended periods, and provide occasional after-hours support for production implementations or critical system issues when required.

• Ability to perform the essential responsibilities of the role with or without reasonable accommodation.

Benefits

• Annual salary: $125,000–$150,000 USD, depending on experience.

• Work arrangement: Remote position.

• Location and time-zone consideration: Candidates based in the United States, particularly those aligned with Central Standard Time (CST) or Eastern Standard Time (EST), are considered.

• Healthcare coverage: Medical, dental, and vision insurance.

• Retirement savings: 401(k) plan with employer matching.

• Paid time off: PTO and paid holidays.

• Additional perks: A comprehensive benefits package and opportunities for professional growth.

• Work environment: A team-oriented setting with opportunities to contribute to security governance, risk management, and enterprise compliance initiatives.

• Work conditions: Primarily remote or office-based computer work, with occasional after-hours support potentially required for critical implementations or system issues.