Sr GRC & Compliance Manager (CST & EST considered)

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Sr. GRC & Compliance Manager (CST & EST considered) based in the United States. The Sr. GRC & Compliance Manager will lead the operational execution and continuous improvement of enterprise security compliance and governance programs. This role is responsible for managing external audits, coordinating control owners, validating evidence, tracking remediation, and ensuring organizational readiness across multiple regulatory and security frameworks. An immediate priority is overseeing the current PCI-DSS audit cycle while establishing a structured AI Governance program. The successful candidate will help transform compliance from a periodic audit exercise into a sustainable, year-round operating model supported by clear ownership, reliable documentation, and proactive risk management. Working closely with security, IT, legal, finance, HR, and business stakeholders, this professional will improve control maturity and provide leadership with clear visibility into risks and compliance progress. This is a remote opportunity for an experienced GRC professional who combines strong technical knowledge with effective cross-functional coordination and program management skills. Accountabilities - Lead the day-to-day execution of security, risk, compliance, and AI governance programs across the organization. - Manage compliance activities related to SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS, ensuring applicable requirements are mapped to relevant controls and business processes. - Prioritize and coordinate the current PCI-DSS audit cycle, including scope definition, control ownership, evidence collection, readiness assessments, remediation, auditor requests, fieldwork, and report completion.

- Establish and develop an AI Governance program, defining appropriate controls, accountability, documentation, and risk management processes. - Maintain a consolidated mapping of audit requirements and controls across applicable business units, systems, and reports. - Assign and monitor control ownership across technology, security, HR, finance, legal, and other relevant stakeholder groups. - Coordinate with control owners to collect, review, organize, and validate audit evidence before submission, ensuring documentation demonstrates that controls are operating as intended. - Manage communications with external auditors, including evidence requests, sample submissions, follow-up questions, status updates, and issue resolution. - Identify control deficiencies, evidence gaps, exceptions, dependencies, and risks, then drive remediation plans with accountable owners, deadlines, and escalation paths. - Maintain a centralized risk register and evidence-tracking process that provides clear visibility into open items, due dates, ownership, and progress. - Develop and maintain compliance policies, standards, control narratives, system descriptions, and other governance documentation. - Establish an annual compliance calendar and recurring control testing and evidence-validation procedures to improve audit readiness throughout the year. - Provide regular reporting to security and technology leadership on audit status, control effectiveness, risks, blockers, remediation progress, and decisions requiring attention. - Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to strengthen control maturity, improve accountability, and address evolving regulatory, customer, and security requirements. - Following the PCI-DSS audit, implement a repeatable year-round compliance operating model that supports future audit cycles and continuous improvement. Requirements - At least five years of professional experience in information security governance, risk management, compliance, auditing, or a closely related discipline.