Sr GRC & Compliance Manager (CST & EST considered)

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Sr. GRC & Compliance Manager (CST & EST considered) based in the United States. The Sr. GRC & Compliance Manager will lead the operational execution and continuous improvement of enterprise security compliance and governance programs. This role is responsible for managing external audits, coordinating control owners, validating evidence, tracking remediation, and ensuring organizational readiness across multiple regulatory and security frameworks. An immediate priority is overseeing the current PCI-DSS audit cycle while establishing a structured AI Governance program. The successful candidate will help transform compliance from a periodic audit exercise into a sustainable, year-round operating model supported by clear ownership, reliable documentation, and proactive risk management. Working closely with security, IT, legal, finance, HR, and business stakeholders, this professional will improve control maturity and provide leadership with clear visibility into risks and compliance progress. This is a remote opportunity for an experienced GRC professional who combines strong technical knowledge with effective cross-functional coordination and program management skills.

Lead the day-to-day execution of security, risk, compliance, and AI governance programs across the organization. Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS, ensuring applicable requirements are mapped to relevant controls and business processes. Prioritize and coordinate the current PCI-DSS audit cycle, including scope definition, control ownership, evidence collection, readiness assessments, remediation, auditor requests, fieldwork, and report completion. Establish and develop an AI Governance program, defining appropriate controls, accountability, documentation, and risk management processes. Maintain a consolidated mapping of audit requirements and controls across applicable business units, systems, and reports. Assign and monitor control ownership across technology, security, HR, finance, legal, and other relevant stakeholder groups. Coordinate with control owners to collect, review, organize, and validate audit evidence before submission, ensuring documentation demonstrates that controls are operating as intended. Manage communications with external auditors, including evidence requests, sample submissions, follow-up questions, status updates, and issue resolution. Identify control deficiencies, evidence gaps, exceptions, dependencies, and risks, then drive remediation plans with accountable owners, deadlines, and escalation paths. Maintain a centralized risk register and evidence-tracking process that provides clear visibility into open items, due dates, ownership, and progress. Develop and maintain compliance policies, standards, control narratives, system descriptions, and other governance documentation. Establish an annual compliance calendar and recurring control testing and evidence-validation procedures to improve audit readiness throughout the year. Provide regular reporting to security and technology leadership on audit status, control effectiveness, risks, blockers, remediation progress, and decisions requiring attention. Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to strengthen control maturity, improve accountability, and address evolving regulatory, customer, and security requirements. Following the PCI-DSS audit, implement a repeatable year-round compliance operating model that supports future audit cycles and continuous improvement. Requirements At least five years of professional experience in information security governance, risk management, compliance, auditing, or a closely related discipline. Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection and validation, auditor coordination, and remediation tracking. Strong understanding of security and IT controls covering identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance. Demonstrated ability to coordinate compliance activities across technical teams and business functions, establish clear control ownership, and maintain stakeholder accountability. Strong evidence-review skills, including the ability to assess whether supporting documentation adequately demonstrates that a control operated as expected. Proven project and program management capabilities, with experience managing deadlines, dependencies, competing priorities, remediation activities, and escalations. Excellent written and verbal communication skills, including the ability to explain technical audit findings, compliance risks, and remediation needs to both technical teams and executive leadership. Strong organizational skills and attention to detail, with the ability to maintain structured documentation, track numerous open items, and provide reliable status reporting. Preferred: Experience managing enterprise compliance programs across multiple entities, departments, or business units. Preferred: Familiarity with GRC or audit management platforms and structured evidence repositories. Preferred: Knowledge of complementary security frameworks and standards, including NIST Cybersecurity Framework (NIST CSF), CIS Controls, and ISO 27001. Preferred: Relevant professional certifications such as CISA, CISM, CRISC, CISSP, or equivalent practical experience. Ability to work effectively in a remote environment, primarily using a computer for extended periods, and provide occasional after-hours support for production implementations or critical system issues when required. Ability to perform the essential responsibilities of the role with or without reasonable accommodation. Benefits Annual salary: $125,000–$150,000 USD, depending on experience. Work arrangement: Remote position. Location and time-zone consideration: Candidates based in the United States, particularly those aligned with Central Standard Time (CST) or Eastern Standard Time (EST), are considered. Healthcare coverage: Medical, dental, and vision insurance. Retirement savings: 401(k) plan with employer matching. Paid time off: PTO and paid holidays. Additional perks: A comprehensive benefits package and opportunities for professional growth. Work environment: A team-oriented setting with opportunities to contribute to security governance, risk management, and enterprise compliance initiatives. Work conditions: Primarily remote or office-based computer work, with occasional after-hours support potentially required for critical implementations or system issues.