Remote Security Compliance Leader GRC & Audit

Sardine; Northern (KY); Hybrid; USD 140,000 - 210,000; Full time

Benefits offered by this job

Generous compensation

Remote-first culture

Health insurance

401(k) match

Home office stipend

MacBook Pro provided

Meal stipend

Learning stipend

Job summary

Sardine is seeking a Security Compliance Lead to own the GRC program end-to-end in a remote US setting. You will partner with engineering, IT, product, security, and legal teams to run audits and control assessments across SOC 2 Type II, PCI DSS, ISO 27001, GDPR/CCPA, and DORA, while driving FedRAMP efforts.

You will manage a Security Compliance Analyst, lead regulatory readiness, and continuously improve the evidence and control framework to support growth and customer trust.

Qualifications

• 7+ years in security compliance, GRC, or audit.
• Deep knowledge of PCI DSS, SOC 2, ISO 27001, GDPR/CCPA, DORA.
• Technical and product fluency with security tech.
• Excellent written and verbal communication, executive-ready docs.
• Experience in fast-growing fintech/payments environments.
• People leadership or readiness to lead a team.

Responsibilities

• Own compliance planning and the program across SOC 2 Type II, PCI DSS, ISO 27001, GDPR/CCPA, and DORA.
• Drive FedRAMP efforts, coordinate NIST SP 800-53 controls and assessments.
• Interface with auditors, regulators, and stakeholders; partner with engineering, IT, product and legal.
• Present objectives, scope, and results to senior management and board.
• Own the control framework and security policy library.
• Own the risk picture, risk register, and reporting cadence.
• Manage customer assurance work with security questionnaires and attestations.
• Lead evidence collection, scans, and process improvements from findings.
• Build product and technical fluency to ground controls in Sardine's tech.
• Look for automation opportunities and streamlined controls.
• Produce executive-ready documentation and lead regulator meetings.
• Develop and scale the team starting with a Security Compliance Analyst.

Job description

Sardine is seeking a Security Compliance Lead to own the GRC program end-to-end in a remote US setting. You will partner with engineering, IT, product, security, and legal teams to run audits and control assessments across SOC 2 Type II, PCI DSS, ISO 27001, GDPR/CCPA, and DORA, while driving FedRAMP efforts.

You will manage a Security Compliance Analyst, lead regulatory readiness, and continuously improve the evidence and control framework to support growth and customer trust.