Senior Manager, Security & Compliance

Navan; New York (NY); On-site; USD 164,000 - 365,000; Full time

Benefits offered by this job

Healthcare coverage

Retirement savings programs

Equity plans

Flexible time off

Job summary

Navan is seeking a Senior Manager of Security and Compliance to own the design, implementation, and maturation of our GRC programs across ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials, with FedRAMP/ITAR/DOD IL4/5 oversight. You will lead a team, drive automation, and report to executives.

The role requires 7+ years in security GRC or IT auditing, strong framework expertise, and deep cloud security knowledge. Location is US-based with in-office expectations.

Qualifications

• 7+ years in security GRC or IT auditing, with leadership
• Experience with ISO 27001, PCI DSS, SOC 1/2, Cyber Essentials, FedRAMP/ITAR/DOD IL4/5 is preferred
• Strong cloud security architecture and access control knowledge
• Ability to translate complex security data for executives

Responsibilities

• Lead multi-framework compliance strategy and audits (ISO 27001, SOC 1/2, PCI DSS, Cyber Essentials)
• Oversee audit scopes and external auditor relationships
• Drive AI-first GRC initiatives for automated evidence collection and monitoring
• Govern security controls testing: access, change control, data recovery
• Ensure systems onboarding follows a compliant-by-design approach
• Mentor GRC analysts and report to senior leadership

Skills

Security GRC leadership

Audit management

Compliance by design

Automation mindset

Executive stakeholder communication

Education

Bachelor’s or Master’s in Cybersecurity/IT

Tools

AWS security controls

AI governance tools

Job description

We are looking for a strategic and hands-on Senior Manager, Security and Compliance to oversee our global GRC function. This leader will be responsible for the design, implementation, and maturation of our comprehensive security compliance programs, ensuring our infrastructure and processes meet the highest industry standards. You will manage a team of specialists to align our security posture with an expanding portfolio of frameworks, including ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials. You will also manage the US Regulated Markets team, which will manage FedRAMP, ITAR, and iL4/5 programs.

What You’ll Do:

Compliance Strategy & Audit Leadership

• Program Oversight: Lead the strategy for multi-framework compliance, executing internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, and Cyber Essentials, along with FedRAMP, ITAR, and DoD IL4/5.
• Audit Management: Act as the senior point of escalation for audit requests, defining testing scopes and managing relationships with external auditors.
• AI and Automation: Champion an AI-first strategy for GRC by integrating artificial intelligence and automated workflows to streamline continuous compliance monitoring, automated evidence collection, and predictive risk management across global frameworks.
• Control Governance: Oversee the regular testing of security controls, including access management, change control, and data recovery.
• Compliance by Design: Ensure all new systems are onboarded into the environment with a \"compliance by design\" approach.

Risk & Governance Management

• Enterprise Risk: Direct periodic assessments of security controls, policies, and standards across the entire organization.
• Remediation Strategy: Lead the identification of control deficiencies and approve robust remediation plans to address gaps.
• Policy Architecture: Author and maintain high-level information security policies and standards to ensure global regulatory alignment.
• GRC Roadmap: Drive the development and implementation of GRC tools and centralized evidence repositories to streamline operations.

Team Leadership & Collaboration

• Mentorship: Manage and develop a team of GRC analysts, fostering a culture of technical excellence and automation.
• Stakeholder Engagement: Partner with leadership in People Ops, Finance, Legal, IT, and Engineering to bridge cross-functional control gaps.
• Executive Reporting: Synthesize complex compliance data into actionable metrics and status reports for senior management.
• Security Culture: Oversee the delivery of security awareness programs and promote compliance best practices company-wide.

What We’re Looking For:

• Experience: 7+ years in security GRC or IT auditing, with at least 2 years in a supervisory or lead capacity.
• Deep Framework Expertise: Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials. Experience in US Regulated markets like FedRAMP, ITAR, DOD IL4/IL5 as well.
• Cloud Infrastructure: Advanced knowledge of security controls within AWS (Azure or GCP is a plus).
• Technical Depth: Practical understanding of security architecture, network security, and access control in cloud-native environments. Understanding of AI, AI governance and guardrails.
• Strategic Communication: Proven ability to communicate complex security and compliance risks to executive stakeholders.
• Automation Mindset: Track record of implementing automated evidence collection and process improvements.

Preferred Qualifications

• Education: Bachelor’s or Master’s degree in Cybersecurity, IT, or a related field.
• Professional Certifications: CISA, CISM, CISSP, or ISO 27001 Lead Auditor are highly preferred.
• Framework Integration: Experience building Unified Control Frameworks (UCF) to map multiple standards simultaneously.
• Regulatory Knowledge: Familiarity with NIST CSF, COBIT, or GDPR.

Success Factors

• Ability to manage multiple high-priority compliance projects and deadlines simultaneously.
• Technical mastery of how security controls satisfy diverse regulatory requirements.
• A proactive approach to monitoring global regulatory changes and emerging security trends.

The posted pay range represents the anticipated low and high end of the compensation for this position and is subject to change based on business need. To determine a successful candidate’s starting pay, we carefully consider a variety of factors, including primary work location, an evaluation of the candidate’s skills and experience, market demands, and internal parity.

For roles with on-target-earnings (OTE), the pay range includes both base salary and target incentive compensation. Target incentive compensation for some roles may include an incentive draw period. Compensation is higher for those who exceed targets. Candidates may receive more information from the recruiter.

Pay Range

$164,025 — $364,700 USD

Navan uses AI-assisted Automated Employment Decision Tool (Metaview) to assist with evaluating resumes against job qualifications for this role. All final decisions are made by human recruiters and hiring managers.

Human oversight: Metaview does not automatically reject candidates or make final hiring decisions. Our recruiters and hiring managers review all outputs and make the final hiring decision regarding every application.

Your rights: If you prefer to have your application reviewed without AI assistance, you may request a human evaluation by entering your email here. Your decision to do so will not affect how your candidacy is evaluated.

Please refer to our Candidate Privacy Notice for more information about our processing of personal data, and your rights.

About Navan

Navan (Nasdaq: NAVN) is the global AI-powered business travel and expense platform that makes travel easy for frequent travelers. From finding flights and hotels, to automating expense reconciliation, with 24/7 support along the way, Navan delivers an intuitive experience travelers love and finance teams rely on. See how Navan customers benefit and learn more at navan.com.

Culture of Excellence

Our team is our competitive edge — a high-performance group of smart, driven people committed to winning together. This dedication to excellence is why we’ve been recognized as a Best Place to Work by Built In (2023–2026), a G2 Best Global Software Company (2025–2026), Forbes Cloud 100 (2022–2025), and CNBC Disruptor 50 (2022–2025). At Navan, we provide an environment where top talent excels, offering the autonomy and fast-paced trajectory needed to build a defining career and do the best work of your life.

Our Benefits

Navan offers a comprehensive benefits program designed to support your well-being, financial security, and life outside of work. Our benefits, thoughtfully tailored by country to meet local needs, include healthcare coverage, insurance offerings, and wellness resources for you and your family.

We support long-term financial growth through retirement savings programs and opportunities to participate in our equity plans, so you can share in Navan’s success. To promote balance, we offer flexible time off, country-specific holidays, and paid parental leave for all new parents. Additional benefits include connectivity and commuting support*, mental health resources, and exclusive travel-related perks. Wherever you’re based, our benefits evolve with you.

Workplace Policy

Navan believes in the value of in-person connections, whether that’s sitting down to have lunch with one another, taking a walking 1:1, or collaborating in a room together. The connections forged through face-to-face interactions improve company culture and drive business results. Navan invests in global office spaces — in the U.S., Europe, and Asia, among others — that feel welcoming. In-office perks such as company-provided lunches and happy hours create a strong team environment to help you do your best work. Our employees work from the office four days a week. Please expect this policy for all roles that are tied to an office.

Equal Opportunity

Navan is an equal opportunity employer. We make all employment decisions based solely on merit. We provide equal employment opportunity to all applicants and employees without discrimination on the bases of race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics. We prohibit any such discrimination or harassment. This policy applies to all terms and conditions of employment, including hiring.

Accommodations

Navan complies with the Americans with Disabilities Act (ADA), as amended by the ADA Amendments Act, and all applicable state or local law. Navan will reasonably accommodate qualified individuals with a disability in connection with applications for employment as required by law.

If you need any assistance or accommodations due to a disability, you are welcome to email us at [e-mail].

Candidate Privacy Notice and Use of AI

As part of the recruitment process, certain personal data may be processed using automated tools, including tools that use AI. For details on how Navan collects and uses your personal data, please review Navan's Candidate Privacy Notice here.

*Applies to select locations.