Sr GRC & Compliance Manager (CST & EST considered)

Jobgether; United States; Remote; USD 125,000 - 150,000; Full time

Benefits offered by this job

Remote position

Healthcare coverage

401(k) plan

Job summary

Jobgether, on behalf of a partner company, seeks a Sr. GRC & Compliance Manager based in the United States.

You will lead security compliance programs, drive audits, and build an AI governance framework while coordinating with security, legal, IT, and operations. This remote role requires five+ years in governance and risk, hands-on SOC 2/ISO 27001/PCI-DSS experience, and strong cross-functional leadership to transform compliance into a year-round operating model with clear ownership and

Qualifications

• At least five years in information security governance and risk management.
• Hands-on SOC 2 or comparable audits experience.
• Knowledge of IT controls (IAM, change management, vulnerability, incident response).
• Ability to coordinate compliance across technical teams and business units.
• Strong evidence-review and documentation skills.
• Proven project and program management capabilities.
• Excellent written and verbal communication.
• Remote-work capable with cross-time-zone coordination.

Responsibilities

• Lead day-to-day security, risk, compliance, and AI governance programs.
• Manage SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS mapping.
• Prioritize and manage PCI-DSS audit cycle including scope, ownership, evidence, readiness, remediation.
• Establish an AI Governance program with controls and risk management processes.
• Maintain centralized risk register and evidence-tracking.
• Coordinate with control owners to collect, review, and validate audit evidence.
• Manage communications with external auditors.
• Identify deficiencies and drive remediation plans with owners.
• Provide regular reporting to leadership on audit status and risks.
• Partner with functions to strengthen control maturity.
• Implement a year-round compliance operating model after PCI-DSS.

Skills

Information security governance

Risk management

Security audits SOC 2

Control mapping

Evidence collection

Remediation tracking

Program management

Cross-functional coordination

Communication skills

Documentation & records

GRC platforms

NIST CSF / CIS Controls / ISO 27001

Professional certifications (CISA/CISM

Tools

GRC platforms

Job description

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Sr. GRC & Compliance Manager (CST & EST considered) based in the United States.

The Sr. GRC & Compliance Manager will lead the operational execution and continuous improvement of enterprise security compliance and governance programs. This role is responsible for managing external audits, coordinating control owners, validating evidence, tracking remediation, and ensuring organizational readiness across multiple regulatory and security frameworks. An immediate priority is overseeing the current PCI-DSS audit cycle while establishing a structured AI Governance program. The successful candidate will help transform compliance from a periodic audit exercise into a sustainable, year-round operating model supported by clear ownership, reliable documentation, and proactive risk management. Working closely with security, IT, legal, finance, HR, and business stakeholders, this professional will improve control maturity and provide leadership with clear visibility into risks and compliance progress. This is a remote opportunity for an experienced GRC professional who combines strong technical knowledge with effective cross-functional coordination and program management skills.

Accountabilities

• Lead the day-to-day execution of security, risk, compliance, and AI governance programs across the organization.
• Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS, ensuring applicable requirements are mapped to relevant controls and business processes.
• Prioritize and coordinate the current PCI-DSS audit cycle, including scope definition, control ownership, evidence collection, readiness assessments, remediation, auditor requests, fieldwork, and report completion.
• Establish and develop an AI Governance program, defining appropriate controls, accountability, documentation, and risk management processes.
• Maintain a consolidated mapping of audit requirements and controls across applicable business units, systems, and reports.
• Assign and monitor control ownership across technology, security, HR, finance, legal, and other relevant stakeholder groups.
• Coordinate with control owners to collect, review, organize, and validate audit evidence before submission, ensuring documentation demonstrates that controls are operating as intended.
• Manage communications with external auditors, including evidence requests, sample submissions, follow-up questions, status updates, and issue resolution.
• Identify control deficiencies, evidence gaps, exceptions, dependencies, and risks, then drive remediation plans with accountable owners, deadlines, and escalation paths.
• Maintain a centralized risk register and evidence-tracking process that provides clear visibility into open items, due dates, ownership, and progress.
• Develop and maintain compliance policies, standards, control narratives, system descriptions, and other governance documentation.
• Establish an annual compliance calendar and recurring control testing and evidence-validation procedures to improve audit readiness throughout the year.
• Provide regular reporting to security and technology leadership on audit status, control effectiveness, risks, blockers, remediation progress, and decisions requiring attention.
• Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to strengthen control maturity, improve accountability, and address evolving regulatory, customer, and security requirements.
• Following the PCI-DSS audit, implement a repeatable year-round compliance operating model that supports future audit cycles and continuous improvement.

Requirements

• At least five years of professional experience in information security governance, risk management, compliance, auditing, or a closely related discipline.
• Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection and validation, auditor coordination, and remediation tracking.
• Strong understanding of security and IT controls covering identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance.
• Demonstrated ability to coordinate compliance activities across technical teams and business functions, establish clear control ownership, and maintain stakeholder accountability.
• Strong evidence-review skills, including the ability to assess whether supporting documentation adequately demonstrates that a control operated as expected.
• Proven project and program management capabilities, with experience managing deadlines, dependencies, competing priorities, remediation activities, and escalations.
• Excellent written and verbal communication skills, including the ability to explain technical audit findings, compliance risks, and remediation needs to both technical teams and executive leadership.
• Strong organizational skills and attention to detail, with the ability to maintain structured documentation, track numerous open items, and provide reliable status reporting.
• Preferred: Experience managing enterprise compliance programs across multiple entities, departments, or business units.
• Preferred: Familiarity with GRC or audit management platforms and structured evidence repositories.
• Preferred: Knowledge of complementary security frameworks and standards, including NIST Cybersecurity Framework (NIST CSF), CIS Controls, and ISO 27001.
• Preferred: Relevant professional certifications such as CISA, CISM, CRISC, CISSP, or equivalent practical experience.
• Ability to work effectively in a remote environment, primarily using a computer for extended periods, and provide occasional after-hours support for production implementations or critical system issues when required.
• Ability to perform the essential responsibilities of the role with or without reasonable accommodation.

Benefits

• Annual salary: $125,000–$150,000 USD, depending on experience.
• Work arrangement: Remote position.
• Location and time-zone consideration: Candidates based in the United States, particularly those aligned with Central Standard Time (CST) or Eastern Standard Time (EST), are considered.
• Healthcare coverage: Medical, dental, and vision insurance.
• Retirement savings: 401(k) plan with employer matching.
• Paid time off: PTO and paid holidays.
• Additional perks: A comprehensive benefits package and opportunities for professional growth.
• Work environment: A team-oriented setting with opportunities to contribute to security governance, risk management, and enterprise compliance initiatives.
• Work conditions: Primarily remote or office-based computer work, with occasional after-hours support potentially required for critical implementations or system issues.