Remote GRC & InfoSec Leader: SOC 1/2, PCI

Neumo; West Jordan (UT); On-site; USD 120,000 - 180,000; Full time

Job summary

Neumo is seeking a Manager, Information Security (GRC) to own and mature its governance, risk, and compliance program. You will drive SOC 1/2 and PCI readiness, build risk management processes, and lead audits with 1–2 direct reports. The role bridges security, legal, engineering, and leadership to translate requirements into practical controls and scalable workflows.

You will modernize risk management, leveraging automation and AI to scale while maintaining strong governance and board reporting.

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Hands-on ownership of SOC 1, SOC 2, and PCI DSS programs with audits.
• Experience building risk registers, acceptance/exception processes, and CCM.
• Familiarity with data governance concepts: classification, ownership, retention.
• Knowledge of GRC platforms (Vanta/Drata/ServiceNow GRC/OneTrust/Archer).
• Certifications such as CISA/CRISC/CISSP/CISM are a plus but not required.

Responsibilities

• Own and execute Neumo's GRC strategy and roadmap with the CISO.
• Mentor 1-2 direct reports across compliance, risk, and audit workstreams.
• Lead SOC 1/2 and PCI DSS readiness, evidence collection and remediation tracking.
• Develop and maintain risk register and monthly/quarterly risk mitigations.
• Design automation to reduce manual evidence and enable CCM.
• Collaborate with Legal, Privacy, and Engineering on regulatory controls.

Skills

GRC

Audit management

Risk assessment

Control automation

Incident management

Jira

Strategic leadership

Education

Bachelor's degree in a related field

Certifications in CISA/CRISC/CISSP/CISM (nice to have)

Tools

Vanta

Drata

ServiceNow GRC

OneTrust

Archer

Jira

Job description

Neumo is seeking a Manager, Information Security (GRC) to own and mature its governance, risk, and compliance program. You will drive SOC 1/2 and PCI readiness, build risk management processes, and lead audits with 1–2 direct reports. The role bridges security, legal, engineering, and leadership to translate requirements into practical controls and scalable workflows.

You will modernize risk management, leveraging automation and AI to scale while maintaining strong governance and board reporting.