Remote Information Security GRC Manager

Neumo; Carrollton (VA); On-site; USD 140,000 - 190,000; Full time

Job summary

Neumo is seeking a Manager, Information Security (GRC) to own and mature its Governance, Risk, and Compliance program. You will drive SOC 1, SOC 2, and PCI DSS readiness, build data governance foundations, and lead risk mitigation cycles.

You will translate regulatory requirements into practical controls, collaborate with legal, engineering, and executives, and guide 1–2 direct reports while advancing automation and AI-driven workflows across the security program.

Qualifications

• 6+ years of experience in GRC, information security compliance, or IT audit.
• Hands-on experience owning SOC 1, SOC 2, and PCI DSS compliance programs end‑to‑end, including audit management.
• Experience with GRC platforms (e.g., Vanta, Drata, ServiceNow GRC, OneTrust, Archer).
• Build risk management programs: risk registers, risk acceptance/exception processes, and recurring risk mitigation cadences.

Responsibilities

• Own end-to-end readiness and execution for SOC 1, SOC 2, and PCI DSS audits, including evidence collection and remediation tracking.
• Lead and mentor 1–2 direct reports supporting compliance, risk, and audit activities.
• Design and implement data governance foundations: classification, ownership, retention, and handling standards.
• Build and maintain the risk register; lead monthly, quarterly, and annual risk mitigation cycles.
• Report on compliance posture, audit status, and risk trends to executives and the board.

Skills

GRC

Audits

Jira

Data governance

Automation

AI tools

Incident management

Policy development

Risk assessment

Education

CISA/CRISC/CISSP/CISM certifications

Tools

Vanta

Drata

ServiceNow GRC

OneTrust

Archer

Job description

Neumo is seeking a Manager, Information Security (GRC) to own and mature its Governance, Risk, and Compliance program. You will drive SOC 1, SOC 2, and PCI DSS readiness, build data governance foundations, and lead risk mitigation cycles.

You will translate regulatory requirements into practical controls, collaborate with legal, engineering, and executives, and guide 1–2 direct reports while advancing automation and AI-driven workflows across the security program.