Senior GRC Manager — Remote, Risk & Compliance Strategy

Sound Physicians; United States; On-site; USD 130,000 - 160,000; Full time

Job summary

Sound Physicians is seeking a Senior Manager, Governance, Risk, and Compliance to lead the enterprise GRC program and report to the CISO. You will drive risk-based decisions, align controls with NIST CSF/ISO 27001, oversee audits, and mentor a growing GRC team.

This remote-first role requires experience in risk assessments and security governance, with collaboration across Security, IT, Legal, and Privacy. The position offers a competitive salary and benefits in a remote US-based setting.

Qualifications

• Knowledge of HIPAA Security rule, NIST CSF, ISO 27001, SOC 2 and security risk practices.
• Experience with risk assessments, audits, and control testing.
• Ability to clearly communicate security risk to senior leaders.
• Experience mentoring GRC team members and cross-organizational collaboration.
• Broad knowledge of technology and security risks.

Responsibilities

• Operate and mature the enterprise GRC program.
• Own the security risk lifecycle, including assessments, tracking, remediation, and escalation of material risks to the CISO.
• Maintain the security policy framework and translate standards (e.g., NIST CSF, ISO 27001, SOC 2) into actionable control requirements.
• Manage security related compliance activities and audits; maintain evidence and track remediation to closure.
• Operate the vendor security risk management program and elevate high risk vendors and systemic issues.
• Produce concise risk and compliance metrics and dashboards for the CISO and senior leadership.
• Mentor GRC staff and act as a trusted advisor to Security, IT, Legal, Privacy, and business teams.
• Partner with the CISO and Sr. Manager of Security Operations to update the Strategic Information Security Program.

Skills

HIPAA Security

NIST CSF

ISO 27001

SOC 2

Risk management

Education

Bachelor’s in Information Security

Job description

Sound Physicians is seeking a Senior Manager, Governance, Risk, and Compliance to lead the enterprise GRC program and report to the CISO. You will drive risk-based decisions, align controls with NIST CSF/ISO 27001, oversee audits, and mentor a growing GRC team.

This remote-first role requires experience in risk assessments and security governance, with collaboration across Security, IT, Legal, and Privacy. The position offers a competitive salary and benefits in a remote US-based setting.