Remote GRC & Information Security Manager

Neumo; Kentucky; On-site; USD 120,000 - 180,000; Full time

Job summary

Neumo seeks a Manager, Information Security (GRC) to own and mature its governance, risk, and compliance program. You will drive SOC 1/2 and PCI DSS readiness, plus build automation and AI-driven workflows to scale the program without linear headcount.

You will translate regulatory requirements into practical controls and communicate risk to executives and the board, partnering with security, legal, and engineering. This role is hands-on leadership with 1–2 direct reports.

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Direct experience owning SOC 1, SOC 2, and PCI DSS compliance end-to-end.
• Hands-on experience with GRC platforms (Vanta, Drata, ServiceNow GRC, OneTrust, Archer).
• Experience building risk management programs: risk registers and risk mitigation cadences.
• Foundational data governance concepts: classification, ownership, retention.
• Certifications (CISA, CRISC, CISSP, CISM) are a plus but not required.

Responsibilities

• Own and execute GRC strategy and roadmap with CISO, mentoring 1–2 reports.
• Manage readiness and execution of SOC 1/2 and PCI DSS audits; track remediation.
• Design and implement control automation to reduce manual evidence collection.
• Leverage AI/LLM tooling to accelerate evidence review and risk analysis.
• Partner with Legal/Privacy on data protection and regulatory requirements.
• Coordinate third-party/vendor risk assessments and questionnaires.

Skills

Jira for control tracking

GRC automation

AI tooling in GRC

Incident management

Cross-team coordination

Education

Certifications: CISA / CRISC / CISSP / CISM

Tools

Vanta

Drata

ServiceNow GRC

OneTrust

Archer

Job description

Neumo seeks a Manager, Information Security (GRC) to own and mature its governance, risk, and compliance program. You will drive SOC 1/2 and PCI DSS readiness, plus build automation and AI-driven workflows to scale the program without linear headcount.

You will translate regulatory requirements into practical controls and communicate risk to executives and the board, partnering with security, legal, and engineering. This role is hands-on leadership with 1–2 direct reports.