Senior Manager, Security & Compliance

Compliance Strategy & Audit Leadership

Risk & Governance Management

Team Leadership & Collaboration

What We’re Looking For:

Preferred Qualifications

• Education: Bachelor’s or Master’s degree in Cybersecurity, IT, or a related field.
• Professional Certifications: CISA, CISM, CISSP, or ISO 27001 Lead Auditor are highly preferred.
• Framework Integration: Experience building Unified Control Frameworks (UCF) to map multiple standards simultaneously.
• Regulatory Knowledge: Familiarity with NIST CSF, COBIT, or GDPR.
• Success Factors
• Ability to manage multiple high-priority compliance projects and deadlines simultaneously.
• Technical mastery of how security controls satisfy diverse regulatory requirements.
• A proactive approach to monitoring global regulatory changes and emerging security trends.
• The posted pay range represents the anticipated low and high end of the compensation for this position and is subject to change based on business need. To determine a successful candidate’s starting pay, we carefully consider a variety of factors, including primary work location, an evaluation of the candidate’s skills and experience, market demands, and internal parity.
• For roles with on-target-earnings (OTE), the pay range includes both base salary and target incentive compensation. Target incentive compensation for some roles may include a ramping draw period. Compensation is higher for those who exceed targets. Candidates may receive more information from the recruiter.Pay Range$164,025—$364,700 USD
• Navan uses AI-assisted Automated Employment Decision Tool (Metaview) to assist with evaluating resumes against job qualifications for this role. All final decisions are made by human recruiters and hiring managers.
• Human oversight: Metaview does not automatically reject candidates or make final hiring decisions. Our recruiters and hiring managers review all outputs and make the final hiring decision regarding every application.
• Your rights: If you prefer to have your application reviewed without AI assistance, you may request a human evaluation by entering your email here. Your decision to do so will not affect how your candidacy is evaluated.
• Please refer to our Candidate Privacy Notice for more information about our processing of personal data, and your rights.
• Cloud Infrastructure: Advanced knowledge of security controls within AWS (Azure or GCP is a plus).

Success Factors

Qualifications

• -
• 7+ years in security GRC or IT auditing, with at least 2 years in a supervisory or lead capacity.
• Deep Framework Expertise: Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials. Experience in US Regulated markets like FedRAMP, ITAR, DOD IL4/IL5 as well.
• Technical Depth: Practical understanding of security architecture, network security, and access control in cloud-native environments. Understanding of AI, AI governance and guardrails.
• Strategic Communication: Proven ability to communicate complex security and compliance risks to executive stakeholders.
• Automation Mindset: Track record of implementing automated evidence collection and process improvements.

Responsibilities

• Program Oversight: Lead the strategy for multi-framework compliance, executing internal and external audits for ISO 27001, SOC 1, SOC 2, PCI DSS, and Cyber Essentials, along with FedRAMP, ITAR, and DoD IL4/5.
• Audit Management: Act as the senior point of escalation for audit requests, defining testing scopes and managing relationships with external auditors.
• AI and Automation: Champion an AI-first strategy for GRC by integrating artificial intelligence and automated workflows to streamline continuous compliance monitoring, automated evidence collection, and predictive risk management across global frameworks.
• Control Governance: Oversee the regular testing of security controls, including access management, change control, and data recovery.
• Compliance by Design: Ensure all new systems are onboarded into the environment with a "compliance by design" approach.
• Enterprise Risk: Direct periodic assessments of security controls, policies, and standards across the entire organization.
• Remediation Strategy: Lead the identification of control deficiencies and approve robust remediation plans to address gaps.
• Policy Architecture: Author and maintain high-level information security policies and standards to ensure global regulatory alignment.
• GRC Roadmap: Drive the development and implementation of GRC tools and centralized evidence repositories to streamline operations.
• Mentorship: Manage and develop a team of GRC analysts, fostering a culture of technical excellence and automation.
• Stakeholder Engagement: Partner with leadership in People Ops, Finance, Legal, IT, and Engineering to bridge cross-functional control gaps.
• Executive Reporting: Synthesize complex compliance data into actionable metrics and status reports for senior management.
• Security Culture: Oversee the delivery of security awareness programs and promote compliance best practices company-wide.
• Experience: 7+ years in security GRC or IT auditing, with at least 2 years in a supervisory or lead capacity.
• Deep Framework Expertise: Expert-level understanding of ISO 27001, PCI DSS, SOC frameworks, and Cyber Essentials. Experience in US Regulated markets like FedRAMP, ITAR, DOD IL4/IL5 as well.
• Cloud Infrastructure: Advanced knowledge of security controls within AWS (Azure or GCP is a plus).
• Technical Depth: Practical understanding of security architecture, network security, and access control in cloud-native environments. Understanding of AI, AI governance and guardrails.
• Strategic Communication: Proven ability to communicate complex security and compliance risks to executive stakeholders.
• Automation Mindset: Track record of implementing automated evidence collection and process improvements.