Senior Manager of Security & Compliance

Navan; New York (NY); Vor Ort; USD 180.000 - 260.000; Vollzeit

Benefits dieser Stelle

Parental leave

Commuter benefits

Healthcare

Flexible Vacation

Health and Wellness

Fuel for Connection

Pet Friendly

IATAN (travel-related discounts)

401k (retirement plan)

Connectivity Allowance

Learning & Development

Zusammenfassung

Navan seeks a strategic Senior Manager for Security and Compliance to lead its global GRC function. You will design, implement, and mature security and compliance programs across ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials, while also handling FedRAMP, ITAR, and DoD IL4/5 signals in US markets.

You will manage a team of specialists, drive an AI-first approach to automated evidence collection and continuous monitoring, and report to senior management with clear risk-based insights.

Qualifikationen

• 7+ years in security GRC or IT auditing.
• 2+ years in a supervisory or lead capacity.
• Experience mapping and aligning multiple frameworks (ISO 27001, PCI DSS, SOC1/2, Cyber Essentials).
• Experience with US Regulated programs (FedRAMP, ITAR, DoD IL4/5) is highly desirable.
• CISA/CISM/CISSP or ISO 27001 Lead Auditor certifications preferred.

Aufgaben

• Oversee the design, implementation, and maturation of global GRC programs.
• Lead audits for ISO 27001, SOC 1/2, PCI DSS, Cyber Essentials, FedRAMP, ITAR, and DoD IL4/5.
• Drive AI-first strategy for GRC with automated evidence collection and risk monitoring.
• Govern security controls testing (access management, change control, data recovery).
• Promote compliance by design for all new systems.
• Direct enterprise risk assessments and remediation planning.
• Author and maintain information security policies and standards.
• Develop GRC roadmap and centralized evidence repositories.
• Lead and mentor a team of GRC analysts; collaborate with cross-functional stakeholders.
• Provide executive reporting and promote a security-aware culture.

Kenntnisse

GRC leadership

Audit management

Security architecture

Cloud security

AI governance

Regulatory risk

Cross-functional collaboration

Executive communication

Policy development

Ausbildung

Bachelor’s or Master’s degree in Cybersecurity or related field

Tools

GRC platforms

GRC tooling

Jobbeschreibung

• We are looking for a strategic and hands-on Senior Manager, Security and Compliance to oversee our global GRC function
• This leader will be responsible for the design, implementation, and maturation of our comprehensive security compliance programs, ensuring our infrastructure and processes meet the highest industry standards
• You will manage a team of specialists to align our security posture with an expanding portfolio of frameworks, including ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials. You will also manage the US Regulated Markets team, which will manage FedRAMP, ITAR, and iL4/5 programs
• Compliance Strategy & Audit Leadership
• Program Oversight: Lead the strategy for multi-framework compliance, executing internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, and Cyber Essentials, along with FedRAMP, ITAR, and DoD IL4/5
• Audit Management: Act as the senior point of escalation for audit requests, defining testing scopes and managing relationships with external auditors
• AI and Automation: Champion an AI-first strategy for GRC by integrating artificial intelligence and automated workflows to streamline continuous compliance monitoring, automated evidence collection, and predictive risk management across global frameworks
• Control Governance: Oversee the regular testing of security controls, including access management, change control, and data recovery
• Compliance by Design: Ensure all new systems are onboarded into the environment with a “compliance by design” approach
• Risk & Governance Management:
• Enterprise Risk: Direct periodic assessments of security controls, policies, and standards across the entire organization
• Remediation Strategy: Lead the identification of control deficiencies and approve robust remediation plans to address gaps
• Policy Architecture: Author and maintain high-level information security policies and standards to ensure global regulatory alignment
• GRC Roadmap: Drive the development and implementation of GRC tools and centralized evidence repositories to streamline operations
• Team Leadership & Collaboration:
• Mentorship: Manage and develop a team of GRC analysts, fostering a culture of technical excellence and automation
• Stakeholder Engagement: Partner with leadership in People Ops, Finance, Legal, IT, and Engineering to bridge cross-functional control gaps
• Executive Reporting: Synthesize complex compliance data into actionable metrics and status reports for senior management
• Security Culture: Oversee the delivery of security awareness programs and promote compliance best practices company-wide

Benefits

• Parental leave
• Commuter benefits
• Healthcare
• Flexible Vacation
• Health and Wellness
• Fuel for Connection
• Pet Friendly
• IATAN (travel-related discounts)
• 401k (retirement plan)
• Connectivity Allowance
• Learning & Development

Cloud Infrastructure: Advanced knowledge of security controls within AWS (Azure or GCP is a plus)Deep Framework Expertise: Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials. Experience in US Regulated markets like FedRAMP, ITAR, DOD IL4/IL5 as wellExperience: 7+ years in security GRC or IT auditing, with at least 2 years in a supervisory or lead capacityTechnical Depth: Practical understanding of security architecture, network security, and access control in cloud-native environments. Understanding of AI, AI governance and guardrailsStrategic Communication: Proven ability to communicate complex security and compliance risks to executive stakeholdersAutomation Mindset: Track record of implementing automated evidence collection and process improvementsEducation: Bachelor’s or Master’s degree in Cybersecurity, IT, or a related fieldProfessional Certifications: CISA, CISM, CISSP, or ISO 27001 Lead Auditor are highly preferredFramework Integration: Experience building Unified Control Frameworks (UCF) to map multiple standards simultaneouslyRegulatory Knowledge: Familiarity with NIST CSF, COBIT, or GDPRTechnical mastery of how security controls satisfy diverse regulatory requirementsAbility to manage multiple high-priority compliance projects and deadlines simultaneouslyA proactive approach to monitoring global regulatory changes and emerging security trends