Audit and Compliance Program Manager

Groq•Worth, IL

22h•$186,600 - $252,400•Hybrid

About The Position

Groq is seeking an Audit and Compliance Program Manager to run its audit program across multiple frameworks. The role will maintain a mapped control set so one test can generate evidence for every applicable framework, administer the GRC tool as the system of record, own IT policies and security training, and execute audits while helping mature the GRC function from reactive to proactive. The role is based in the Dallas, San Francisco, or New York City area. The person hired must be based in one of these three areas. The position can be performed remotely while Groq establishes a local office, with the expectation that it will transition to onsite once the office opens. The total cash salary range for U.S.-based candidates is $186,600–$252,400, inclusive of potential bonus value. Individual placement depends on geographic location, experience, skills, and alignment with internal compensation standards. Compensation for international candidates will vary based on local market dynamics. Groq also offers a Long-Term Incentive (LTI) Program and employee benefits.

Requirements

At least 5 years of experience in compliance program management.
Hands-on execution of audits for at least two concurrent frameworks.
Experience mapping controls across frameworks and reducing duplicate evidence collection.
Experience administering a GRC platform as a system of record.
Experience managing external auditors, drafting scope statements for executive review, and coordinating SMEs across stakeholders.
Experience owning a policy lifecycle and a security awareness training program, with completion evidence that has stood up in an audit.
Must be based in the Dallas, San Francisco, or New York City area.

Nice To Haves

Experience at a Big 4 or equivalent audit firm delivering compliance engagements.
Legal background preferred.

Responsibilities

Run the audit calendar across SOC 2 Type II, ISO 27001:2022, and other frameworks; manage auditor relationships, fieldwork logistics, and evidence readiness.
Track audit findings through closure with owners and target dates to prevent recurring findings between audit cycles.
Maintain the control catalogue and framework mapping so one control test can produce evidence for every applicable framework; coordinate SME evidence requests so each control is evidenced once per period rather than once per framework.
Maintain Vanta GRC as the system of record, including integration coverage, automated evidence, test ownership, and documentation within review cycles.
Own the IT policy lifecycle, including review cadence, approvals, and acknowledgements.
Own the security awareness training program and track completion as audit evidence.
Regularly report audit status, open findings, and evidence coverage to security leadership.