Sr GRC & Compliance Manager (CST & EST considered)

Jobgether; United States; À distance; USD 125 000 - 150 000; Plein temps

Avantages offerts par ce poste

Remote position

Healthcare coverage

401(k) plan with employer matching

PTO and holidays

Professional growth opportunities

Résumé du poste

Jobgether is hiring a senior security governance professional to lead cross-functional risk, compliance, and AI governance initiatives. The role focuses on executing security programs, coordinating SOC 2 ISO 27001 and PCI-DSS audits, and driving remediation with accountable owners.

The candidate will build AI governance controls and maintain evidence-ready documentation, while partnering with Security, IT, Legal, HR, Finance, Internal Audit, and business teams across the United States.

Qualifications

• 5+ years of professional experience in information security governance, risk management, compliance, auditing, or related discipline.
• Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection and validation, auditor coordination, and remediation tracking.
• Strong understanding of security and IT controls across IAM, change management, vulnerability, incident response, logging, backup/recovery, third-party risk, and governance.
• Ability to coordinate compliance activities across technical teams and business functions, establish clear control ownership, and maintain stakeholder accountability.
• Strong evidence-review skills to assess documentation that demonstrates controls operate as intended.

Responsabilités

• Lead day-to-day execution of security, risk, compliance, and AI governance programs across the organization.
• Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS; map requirements to controls and processes.
• Coordinate PCI-DSS audit cycle: scope, ownership, evidence, readiness, remediation, auditor requests, fieldwork, reports.
• Develop and maintain AI governance program with controls, accountability, documentation, and risk management.
• Maintain centralized mapping of audit requirements and controls across units, systems, and reports.

Connaissances

InfoSec governance

Risk management

Compliance audits

Auditing

Stakeholder coordination

Outils

GRC platforms

Audit management tools

Description du poste

Accountabilities

• Lead the day-to-day execution of security, risk, compliance, and AI governance programs across the organization.
• Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS, ensuring applicable requirements are mapped to relevant controls and business processes.
• Prioritize and coordinate the current PCI-DSS audit cycle, including scope definition, control ownership, evidence collection, readiness assessments, remediation, auditor requests, fieldwork, and report completion.
• Establish and develop an AI Governance program, defining appropriate controls, accountability, documentation, and risk management processes.
• Maintain a consolidated mapping of audit requirements and controls across applicable business units, systems, and reports.
• Assign and monitor control ownership across technology, security, HR, finance, legal, and other relevant stakeholder groups.
• Coordinate with control owners to collect, review, organize, and validate audit evidence before submission, ensuring documentation demonstrates that controls are operating as intended.
• Manage communications with external auditors, including evidence requests, sample submissions, follow-up questions, status updates, and issue resolution.
• Identify control deficiencies, evidence gaps, exceptions, dependencies, and risks, then drive remediation plans with accountable owners, deadlines, and escalation paths.
• Maintain a centralized risk register and evidence-tracking process that provides clear visibility into open items, due dates, ownership, and progress.
• Develop and maintain compliance policies, standards, control narratives, system descriptions, and other governance documentation.
• Establish an annual compliance calendar and recurring control testing and evidence-validation procedures to improve audit readiness throughout the year.
• Provide regular reporting to security and technology leadership on audit status, control effectiveness, risks, blockers, remediation progress, and decisions requiring attention.
• Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to strengthen control maturity, improve accountability, and address evolving regulatory, customer, and security requirements.
• Following the PCI-DSS audit, implement a repeatable year-round compliance operating model that supports future audit cycles and continuous improvement.

Requirements

• At least five years of professional experience in information security governance, risk management, compliance, auditing, or a closely related discipline.
• Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection and validation, auditor coordination, and remediation tracking.
• Strong understanding of security and IT controls covering identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance.
• Demonstrated ability to coordinate compliance activities across technical teams and business functions, establish clear control ownership, and maintain stakeholder accountability.
• Strong evidence-review skills, including the ability to assess whether supporting documentation adequately demonstrates that a control operated as expected.
• Proven project and program management capabilities, with experience managing deadlines, dependencies, competing priorities, remediation activities, and escalations.
• Excellent written and verbal communication skills, including the ability to explain technical audit findings, compliance risks, and remediation needs to both technical teams and executive leadership.
• Strong organizational skills and attention to detail, with the ability to maintain structured documentation, track numerous open items, and provide reliable status reporting.
• Preferred: Experience managing enterprise compliance programs across multiple entities, departments, or business units.
• Preferred: Familiarity with GRC or audit management platforms and structured evidence repositories.
• Preferred: Knowledge of complementary security frameworks and standards, including NIST Cybersecurity Framework (NIST CSF), CIS Controls, and ISO 27001.
• Preferred: Relevant professional certifications such as CISA, CISM, CRISC, CISSP, or equivalent practical experience.
• Ability to work effectively in a remote environment, primarily using a computer for extended periods, and provide occasional after-hours support for production implementations or critical system issues when required.
• Ability to perform the essential responsibilities of the role with or without reasonable accommodation.

Benefits

• Annual salary: $125,000–$150,000 USD, depending on experience.
• Work arrangement: Remote position.
• Location and time-zone consideration: Candidates based in the United States, particularly those aligned with Central Standard Time (CST) or Eastern Standard Time (EST), are considered.
• Healthcare coverage: Medical, dental, and vision insurance.
• Retirement savings: 401(k) plan with employer matching.
• Paid time off: PTO and paid holidays.
• Additional perks: A comprehensive benefits package and opportunities for professional growth.
• Work environment: A team-oriented setting with opportunities to contribute to security governance, risk management, and enterprise compliance initiatives.
• Work conditions: Primarily remote or office-based computer work, with occasional after-hours support potentially required for critical implementations or system issues.