Senior Manager, Security & Compliance

Navan•Boston, MA

19h•$164,025 - $364,700

About The Position

Navan is seeking a strategic and hands-on Senior Manager, Security and Compliance to oversee its global GRC function. The role leads the design, implementation, and maturation of security compliance programs, aligning the organization’s infrastructure and processes with industry standards and an expanding portfolio of frameworks. The position manages a team of specialists and the US Regulated Markets team, which manages FedRAMP, ITAR, and DoD IL4/5 programs. The Senior Manager leads multi-framework compliance strategy and internal and external audits, serves as a senior escalation point for audit requests, and oversees security control testing and compliance-by-design onboarding of new systems. The role directs enterprise risk assessments, remediation planning, security policy and standards development, and the GRC tools and evidence repositories roadmap. It also champions AI and automation for continuous monitoring, evidence collection, and risk management. The position develops GRC staff, partners with leadership across People Ops, Finance, Legal, IT, and Engineering, and reports compliance status and metrics to senior management. It also oversees company-wide security awareness programs and promotes compliance best practices.

Requirements

At least 7 years of experience in security GRC or IT auditing.
At least 2 years in a supervisory or lead capacity.
Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials.
Experience with US regulated markets, including FedRAMP, ITAR, and DoD IL4/IL5.
Advanced knowledge of security controls within AWS; Azure or GCP knowledge is a plus.
Practical understanding of security architecture, network security, and access control in cloud-native environments.
Understanding of AI, AI governance, and guardrails.
Ability to communicate complex security and compliance risks to executive stakeholders.
Track record of implementing automated evidence collection and process improvements.
Ability to manage multiple high-priority compliance projects and deadlines simultaneously.
Technical mastery of how security controls satisfy diverse regulatory requirements.
Proactive approach to monitoring global regulatory changes and emerging security trends.

Nice To Haves

Bachelor’s or Master’s degree in Cybersecurity, IT, or a related field.
CISA, CISM, CISSP, or ISO 27001 Lead Auditor certification.
Experience building Unified Control Frameworks (UCF) to map multiple standards.
Familiarity with NIST CSF, COBIT, or GDPR.
Knowledge of Azure or GCP security controls.

Responsibilities

Lead strategy for multi-framework compliance and execute internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, Cyber Essentials, FedRAMP, ITAR, and DoD IL4/5.
Serve as the senior escalation point for audit requests, define testing scopes, and manage relationships with external auditors.
Promote an AI-first GRC strategy by integrating AI and automated workflows for continuous compliance monitoring, evidence collection, and predictive risk management.
Oversee regular testing of security controls, including access management, change control, and data recovery.
Ensure new systems are onboarded using a compliance-by-design approach.
Direct periodic organization-wide assessments of security controls, policies, and standards.
Lead identification of control deficiencies and approve remediation plans.
Author and maintain high-level information security policies and standards for global regulatory alignment.
Drive development and implementation of GRC tools and centralized evidence repositories.
Manage and develop a team of GRC analysts, fostering technical excellence and automation.
Partner with People Ops, Finance, Legal, IT, and Engineering leadership to address cross-functional control gaps.
Provide senior management with actionable compliance metrics and status reports.
Oversee security awareness programs and promote company-wide compliance best practices.
Manage the US Regulated Markets team responsible for FedRAMP, ITAR, and DoD IL4/5 programs.
Monitor global regulatory changes and emerging security trends while managing multiple compliance projects and deadlines.