Senior Compliance Program Manager, GRC

Role overview

Manage security compliance and governance programs across enterprise and regulated environments. You will coordinate audits, continuous monitoring, remediation, vendor risk, policies, training, and supporting evidence, turning regulatory obligations into clear plans and accountable work across technical and business teams.

Responsibilities

- Coordinate audit cycles, compliance initiatives, evidence collection, remediation, and continuous monitoring activities. - Set program scope, milestones, owners, dependencies, and reporting across Security, Engineering, DevOps, IT, and governance teams. - Maintain integrated plans and risk, issue, and dependency tracking; raise blockers with practical recommendations. - Support compliance documentation and responses for customer reviews, contracts, and requests for proposals. - Assess vendors and business partners, review their security evidence, track risks, and coordinate remediation or risk acceptance. - Maintain information security policies, standards, procedures, control narratives, system security documentation, and employee training. - Explain technical and regulatory requirements clearly to auditors, leaders, employees, and other stakeholders.

Requirements

- 6+ years of progressive experience in information security compliance, governance, risk, audit, program management, or a related field. - 3+ years leading audits, assessments, or compliance initiatives under frameworks such as NIST 800-53, FedRAMP, SOC 2, or ISO 27001. - Working knowledge of NIST 800-53 Rev. 5, the NIST Risk Management Framework, FedRAMP, SOC 2, and ISO 27001. - Experience managing complex cross-functional programs from planning through completion, including risks, issues, dependencies, and stakeholder communication. - Experience with regulated or federal cloud environments and authorization materials such as system security plans, POA&Ms, or continuous monitoring evidence. - Background in third-party risk, policy governance, security training, and controlled documentation reviews.

Nice to have

Relevant credentials may include PMP, CISSP, CISA, CISM, CRISC, CGRC, or ISO 27001 Lead Auditor. Direct FedRAMP High or DoD IL5 experience, vendor assessments, training platforms, and customer-facing security responses are also useful.

Benefits and work setup

The position is remote from select locations, with a hybrid option for candidates near Chicago or El Dorado Hills. Benefits include medical, dental, and vision coverage; life and disability insurance; a 401(k) plan; paid time off; and annual bonuses.