Senior Security & Compliance Leader, AI-Driven GRC

Navan; New York (NY); On-site; USD 164,000 - 365,000; Full time

Benefits offered by this job

Healthcare coverage

Retirement savings programs

Equity plans

Flexible time off

Job summary

Navan is seeking a Senior Manager of Security and Compliance to own the design, implementation, and maturation of our GRC programs across ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials, with FedRAMP/ITAR/DOD IL4/5 oversight. You will lead a team, drive automation, and report to executives.

The role requires 7+ years in security GRC or IT auditing, strong framework expertise, and deep cloud security knowledge. Location is US-based with in-office expectations.

Qualifications

• 7+ years in security GRC or IT auditing, with leadership
• Experience with ISO 27001, PCI DSS, SOC 1/2, Cyber Essentials, FedRAMP/ITAR/DOD IL4/5 is preferred
• Strong cloud security architecture and access control knowledge
• Ability to translate complex security data for executives

Responsibilities

• Lead multi-framework compliance strategy and audits (ISO 27001, SOC 1/2, PCI DSS, Cyber Essentials)
• Oversee audit scopes and external auditor relationships
• Drive AI-first GRC initiatives for automated evidence collection and monitoring
• Govern security controls testing: access, change control, data recovery
• Ensure systems onboarding follows a compliant-by-design approach
• Mentor GRC analysts and report to senior leadership

Skills

Security GRC leadership

Audit management

Compliance by design

Automation mindset

Executive stakeholder communication

Education

Bachelor’s or Master’s in Cybersecurity/IT

Tools

AWS security controls

AI governance tools

Job description

Navan is seeking a Senior Manager of Security and Compliance to own the design, implementation, and maturation of our GRC programs across ISO 27001, PCI DSS, SOC 1/2, and Cyber Essentials, with FedRAMP/ITAR/DOD IL4/5 oversight. You will lead a team, drive automation, and report to executives.

The role requires 7+ years in security GRC or IT auditing, strong framework expertise, and deep cloud security knowledge. Location is US-based with in-office expectations.