Governance, Risk & Compliance (GRC) Manager

Merci Technologies, Inc.; United States; Hybrid; USD 120,000 - 180,000; Full time

Job summary

Merci Technologies, Inc. is seeking an experienced Governance, Risk & Compliance (GRC) Manager to lead enterprise cybersecurity governance, regulatory compliance, risk management, audit readiness, and security policy initiatives.

This role bridges security operations with executive leadership, auditors, regulators, and business stakeholders. The ideal candidate will develop and maintain policies, standards, and procedures; conduct risk assessments; manage SOC 2, ISO 27001, NIST, HIPAA, PCI-DSS,

Qualifications

• Minimum 7+ years in information security, compliance, audit, or GRC.
•  

Responsibilities

• Lead the organization's GRC program.
•  

Skills

GRC leadership

Regulatory compliance

Audit readiness

Policy development

Stakeholder communication

Risk assessment

Education

Bachelor's degree in cybersecurity / information systems / risk management

Tools

Archer

AuditBoard

ServiceNow GRC

Drata

Job description

Location: Remote (U.S.) / Hybrid
Employment Type: Full-Time
Experience: 7+ Years
Industry: Cybersecurity / Risk & Compliance

About the Opportunity

Merci Technologies is partnering with a client seeking an experienced Governance, Risk & Compliance (GRC) Manager to lead enterprise cybersecurity governance, regulatory compliance, risk management, audit readiness, and security policy initiatives.

This role is ideal for a cybersecurity leader who can bridge the gap between security operations, executive leadership, auditors, regulators, and business stakeholders.

Key Responsibilities

• Lead the organization's Governance, Risk, and Compliance (GRC) program.
• Develop and maintain cybersecurity policies, standards, and procedures.
• Conduct enterprise security risk assessments and remediation planning.
• Manage compliance initiatives including SOC 2, ISO 27001, NIST, HIPAA, PCI-DSS, and GDPR where applicable.
• Coordinate internal and external audits.
• Develop and monitor security controls and compliance frameworks.
• Oversee third-party risk management and vendor security assessments.
• Create executive-level compliance and risk reporting dashboards.
• Partner with Legal, IT, Security, HR, and Operations teams.
• Maintain risk registers and ensure mitigation activities are tracked.
• Support customer security reviews and due diligence requests.
• Drive continuous improvement in governance and compliance processes.
• Educate stakeholders on compliance obligations and cybersecurity risks.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Business, Risk Management, or related field.
• 7+ years of experience in information security, compliance, audit, or GRC.
• Strong understanding of cybersecurity frameworks and regulatory requirements.
• Experience managing SOC 2, ISO 27001, NIST CSF, or similar programs.
• Experience conducting risk assessments and control evaluations.
• Knowledge of third-party risk management methodologies.
• Strong documentation, reporting, and communication skills.
• Ability to work effectively with executive leadership and auditors.

Preferred Qualifications

• CISSP, CISM, CISA, CRISC, Security+, or similar certifications.
• Experience with GRC platforms such as Archer, AuditBoard, ServiceNow GRC, Drata, Vanta, or Secureframe.
• Experience supporting cloud environments (Azure, AWS, or GCP).
• Background in cybersecurity governance and security operations.
• Experience in highly regulated industries.

Why Join This Opportunity?

• Lead enterprise-wide cybersecurity governance initiatives.
• Influence security strategy and business risk decisions.
• Work closely with executive leadership and external auditors.
• Help shape a mature and scalable cybersecurity compliance program.
• Support an organization committed to security, governance, and operational excellence.

About Merci Technologies

Merci Technologies partners with organizations across multiple industries to identify and deliver exceptional talent in Cybersecurity, Cloud, Artificial Intelligence, Data & Analytics, Digital Transformation, Risk & Compliance, and Enterprise Technology.