Senior Manager, Security & Compliance

Navan•Boston, NY

13h

About The Position

The Senior Manager, Security & Compliance is a strategic and hands-on leader responsible for overseeing the global GRC function and managing the US Regulated Markets team. The role designs, implements, and matures security compliance programs, aligning infrastructure and processes with ISO 27001, PCI DSS, SOC 1/2, Cyber Essentials, FedRAMP, ITAR, and DoD IL4/5 requirements. The position leads multi-framework compliance strategy and audit activities, including defining audit scopes and serving as the senior escalation point for audit requests. It champions an AI-first approach to GRC through automated workflows for continuous compliance monitoring, evidence collection, and predictive risk management. The role also oversees security control testing and ensures new systems follow a compliance-by-design approach. The Senior Manager directs enterprise risk assessments, control remediation, security policy and standards development, and the GRC tools and evidence-repository roadmap. They manage and develop GRC analysts, collaborate with People Ops, Finance, Legal, IT, and Engineering, report compliance metrics to senior management, and oversee security awareness programs.

Requirements

At least 7 years of experience in security GRC or IT auditing.
At least 2 years in a supervisory or lead capacity.
Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials.
Experience with US regulated markets, including FedRAMP, ITAR, and DoD IL4/IL5.
Advanced knowledge of security controls within AWS.
Practical understanding of security architecture, network security, and access control in cloud-native environments.
Understanding of AI, AI governance, and guardrails.
Proven ability to communicate complex security and compliance risks to executive stakeholders.
Track record of implementing automated evidence collection and process improvements.
Ability to manage multiple high-priority compliance projects and deadlines simultaneously.
Technical mastery of how security controls satisfy diverse regulatory requirements.
Proactive approach to monitoring global regulatory changes and emerging security trends.

Nice To Haves

Bachelor’s or Master’s degree in Cybersecurity, IT, or a related field.
CISA, CISM, CISSP, or ISO 27001 Lead Auditor certification.
Experience building Unified Control Frameworks (UCF) to map multiple standards simultaneously.
Familiarity with NIST CSF, COBIT, or GDPR.
Knowledge of Azure or GCP security controls.

Responsibilities

Lead the strategy for multi-framework compliance and execute internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, Cyber Essentials, FedRAMP, ITAR, and DoD IL4/5.
Serve as the senior escalation point for audit requests, define testing scopes, and manage relationships with external auditors.
Integrate AI and automated workflows to streamline continuous compliance monitoring, evidence collection, and predictive risk management.
Oversee regular testing of security controls, including access management, change control, and data recovery.
Ensure new systems are onboarded using a compliance-by-design approach.
Direct periodic assessments of security controls, policies, and standards across the organization.
Lead identification of control deficiencies and approve remediation plans.
Author and maintain high-level information security policies and standards for global regulatory alignment.
Develop and implement GRC tools and centralized evidence repositories.
Manage and develop a team of GRC analysts, fostering technical excellence and automation.
Partner with People Ops, Finance, Legal, IT, and Engineering to address cross-functional control gaps.
Provide senior management with actionable compliance metrics and status reports.
Oversee security awareness programs and promote company-wide compliance best practices.
Monitor global regulatory changes and emerging security trends.
Manage multiple high-priority compliance projects and deadlines.