Senior Manager, Security & Compliance

tripactions; Boston (MA); On-site; USD 164,000 - 365,000; Full time

Job summary

TripActions is seeking a Senior Manager, Security and Compliance to lead our global GRC program from Boston. You will design, implement, and mature security and regulatory controls across ISO 27001, PCI DSS, SOC 1/2, Cyber Essentials, FedRAMP, ITAR, and DoD IL4/5, directing a team of GRC specialists.

This role partners with People Ops, Finance, Legal, IT, and Engineering to drive risk-based decisions, automate evidence collection, and report to executives.

Qualifications

• 7+ years in security GRC or IT auditing with leadership experience.
• Expert knowledge of ISO 27001, PCI DSS, SOC, and NIST.
• Experience with FedRAMP, ITAR, and DoD IL4/5 programs.

Responsibilities

• Lead multi-framework compliance strategy and audits.
• Oversee risk governance, policy architecture, and standards.
• Mentor GRC analysts and report to executives.
• Automate evidence collection and monitoring.

Skills

GRC leadership

Audit management

ISO 27001

PCI DSS

SOC 1/2

FedRAMP

ITAR

DOD IL4/5

Cloud security

AI governance

Education

Bachelor's degree in Cybersecurity

CISA

CISM

CISSP

ISO 27001 Lead Auditor

Tools

AWS

Azure

GCP

GRC tools

Job description

We are looking for a strategic and hands-on Senior Manager, Security and Compliance to oversee our global GRC function. This leader will be responsible for the design, implementation, and maturation of our comprehensive security compliance programs, ensuring our infrastructure and processes meet the highest industry standards. You will manage a team of specialists to align our security posture with an expanding portfolio of frameworks, including ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials. You will also manage the US Regulated Markets team, which will manage FedRAMP, ITAR, and iL4/5 programs.

What You'll Do:

Compliance Strategy & Audit Leadership

• Program Oversight : Lead the strategy for multi-framework compliance, executing internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, and Cyber Essentials, along with FedRAMP, ITAR, and DoD IL4/5.
• Audit Management : Act as the senior point of escalation for audit requests, defining testing scopes and managing relationships with external auditors.
• AI and Automation : Champion an AI-first strategy for GRC by integrating artificial intelligence and automated workflows to streamline continuous compliance monitoring, automated evidence collection, and predictive risk management across global frameworks.
• Control Governance : Oversee the regular testing of security controls, including access management, change control, and data recovery.
• Compliance by Design : Ensure all new systems are onboarded into the environment with a "compliance by design" approach.

Risk & Governance Management

• Enterprise Risk : Direct periodic assessments of security controls, policies, and standards across the entire organization.
• Remediation Strategy : Lead the identification of control deficiencies and approve robust remediation plans to address gaps.
• Policy Architecture : Author and maintain high-level information security policies and standards to ensure global regulatory alignment.
• GRC Roadmap : Drive the development and implementation of GRC tools and centralized evidence repositories to streamline operations.

Team Leadership & Collaboration

• Mentorship : Manage and develop a team of GRC analysts, fostering a culture of technical excellence and automation.
• Stakeholder Engagement : Partner with leadership in People Ops, Finance, Legal, IT, and Engineering to bridge cross-functional control gaps.
• Executive Reporting : Synthesize complex compliance data into actionable metrics and status reports for senior management.
• Security Culture : Oversee the delivery of security awareness programs and promote compliance best practices company-wide.

What We're Looking For:

• Experience : 7+ years in security GRC or IT auditing, with at least 2 years in a supervisory or lead capacity.
• Deep Framework Expertise : Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials. Experience in US Regulated markets like FedRAMP, ITAR, DOD IL4/IL5 as well.
• Cloud Infrastructure : Advanced knowledge of security controls within AWS (Azure or GCP is a plus).
• Technical Depth : Practical understanding of security architecture, network security, and access control in cloud-native environments. Understanding of AI, AI governance and guardrails.
• Strategic Communication : Proven ability to communicate complex security and compliance risks to executive stakeholders.
• Automation Mindset : Track record of implementing automated evidence collection and process improvements.

Preferred Qualifications

• Education : Bachelor's or Master's degree in Cybersecurity, IT, or a related field.
• Professional Certifications : CISA, CISM, CISSP, or ISO 27001 Lead Auditor are highly preferred.
• Framework Integration : Experience building Unified Control Frameworks (UCF) to map multiple standards simultaneously.
• Regulatory Knowledge : Familiarity with NIST CSF, COBIT, or GDPR.

Success Factors

• Ability to manage multiple high-priority compliance projects and deadlines simultaneously.
• Technical mastery of how security controls satisfy diverse regulatory requirements.
• A proactive approach to monitoring global regulatory changes and emerging security trends.

The posted pay range represents the anticipated low and high end of the compensation for this position and is subject to change based on business need. To determine a successful candidate's starting pay, we carefully consider a variety of factors, including primary work location, an evaluation of the candidate's skills and experience, market demands, and internal parity.

For roles with on-target-earnings (OTE), the pay range includes both base salary and target incentive compensation. Target incentive compensation for some roles may include a ramping draw period. Compensation is higher for those who exceed targets.

Pay Range

$164,025 - $364,700 USD