Remote GRC & Information Security Manager

Neumo; Illinois; On-site; USD 130,000 - 185,000; Full time

Job summary

Neumo is seeking a Manager, Information Security (GRC) to own and mature the GRC program, ensuring SOC 1, SOC 2, and PCI certifications remain current. You will lead the data governance foundation, manage risk acceptance, and drive automation and AI-driven workflows to scale governance without linear headcount growth.

You will oversee audits, risk assessments, and control automation, partnering with security, legal, engineering, and leadership to translate requirements into practical controls

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Direct experience owning SOC 1, SOC 2, and PCI DSS programs end-to-end, including audit management.
• Hands-on experience with GRC platforms (e.g., Vanta, Drata, ServiceNow GRC, OneTrust, Archer).
• Experience building risk management programs: risk registers, risk acceptance/exception processes, and recurring risk mitigation cadences.
• Foundational experience with data governance concepts (classification, ownership, retention).
• Relevant certifications such as CISA, CRISC, CISSP, CISM are a plus but not required.

Responsibilities

• Own and execute Neumo's GRC strategy and roadmap with the CISO.
• Mentor and grow 1-2 direct reports in compliance, risk, and audit activities.
• Set the foundation for data governance: classification, ownership, retention, handling standards.
• Maintain the risk register and lead regular risk mitigation cycles.
• Own risk acceptance and policy exception processes, including documentation and approvals.
• Report on compliance posture, audit status, and risk trends to executives and the board.

Skills

GRC

Information security

Audit management

Regulatory compliance

Risk management

Jira

AI tooling

Tools

Vanta

Drata

ServiceNow GRC

OneTrust

Archer

Job description

Neumo is seeking a Manager, Information Security (GRC) to own and mature the GRC program, ensuring SOC 1, SOC 2, and PCI certifications remain current. You will lead the data governance foundation, manage risk acceptance, and drive automation and AI-driven workflows to scale governance without linear headcount growth.

You will oversee audits, risk assessments, and control automation, partnering with security, legal, engineering, and leadership to translate requirements into practical controls