Senior Compliance Program Manager, GRC

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee intricate compliance and governance projects within Keeper’s enterprise and regulated settings, such as FedRAMP High and DoD IL5.

• Strategize and execute compliance programs throughout audit cycles, ongoing monitoring, POA&M remediation, policy initiatives, and supporting documentation.

• Define program scope, milestones, dependencies, ownership, and reporting across Security, Engineering, DevOps, IT, and GRC.

• Sustain integrated program plans, risks, assumptions, issues, and dependencies while escalating blockers with clear recommendations.

• Organize evidence collection, remediation tracking, and control-owner activities for compliance and audit efforts.

• Collaborate with GRC and ISSO stakeholders on audit preparedness, control documentation, remediation, and continuous monitoring tasks.

• Keep abreast of changing regulatory and security requirements, assessing their potential impact on business and operations.

• Assist with compliance responses for clients, contracts, security evaluations, and RFPs.

• Contribute to the enhancement of Keeper’s third-party risk management program, including risk-tiered assessments of vendors and business partners.

• Evaluate vendor security documentation, attestations, and supply chain risk factors, providing risk-based recommendations.

• Collaborate with Procurement, Legal, and business owners on security requirements, contract terms, and remediation expectations.

• Maintain the third-party risk register, tracking remediation, risk acceptance, and program metrics.

• Create, maintain, and govern information security policies, standards, procedures, and control narratives.

• Support System Security Plan documentation along with other compliance-related technical documents.

• Develop and deliver information security training for employees and specific role audiences.

• Oversee training lifecycle activities, including scheduling, learning management system administration, completion tracking, phishing simulations, and audit evidence.

• Create training materials, job aids, scenarios, and assessments in collaboration with subject matter experts.

• Assess and report training effectiveness using completion, assessment, and behavioral metrics.

• Partner with Engineering and Product teams to verify technical information and maintain accurate, audit-ready documentation.

• Simplify complex technical and regulatory information into clear documentation for auditors, leadership, and internal stakeholders.

• Mentor team members and cross-functional partners on compliance procedures and documentation practices.

• Utilize AI-assisted tools such as Claude, ChatGPT, or similar platforms to enhance regulatory research, documentation, analysis, training development, and workflow efficiency.

⛳️ Requirements

• A minimum of 6 years of progressive experience in information security compliance, governance, risk, audit, program management, or a related field.

• At least 3 years of experience leading audits, assessments, or compliance initiatives involving frameworks such as NIST 800-53, FedRAMP, SOC 2, ISO 27001, or similar.

• Strong working knowledge of NIST 800-53 Rev. 5, NIST RMF, FedRAMP, SOC 2, ISO 27001, and other related compliance requirements.

• Proven experience managing complex cross-functional compliance programs from inception to completion.

• Background in regulated or federal cloud environments, particularly those involving FedRAMP High, DoD IL4/IL5, or similar requirements.

• Familiarity with authorization documentation such as System Security Plans, POA&Ms, continuous monitoring artifacts, or related evidence.

• Experience in supporting or managing third-party risk management programs.

• Proven track record in developing and governing information security policies, standards, and procedures.

• Experience in developing or delivering information security training for both technical and non-technical audiences.

• Strong program management skills, including planning, scheduling, risk and issue management, dependency tracking, and stakeholder communication.

• Exceptional documentation governance skills, including managing reviews, approvals, versioning, and controlled release.

• Strong capability to interpret technical and regulatory requirements and convert them into actionable operational guidance.

• Excellent written and verbal communication skills, with experience engaging with executives, auditors, and technical stakeholders.

• Ability to work independently, manage multiple concurrent initiatives, and influence cross-functional stakeholders without direct authority.

• Willingness and ability to effectively utilize AI-assisted tools to support compliance research, documentation, analysis, and program execution.

• Bachelor's degree in Information Security, Information Systems, Computer Science, Business Administration, Technical Communication, or a related field, or equivalent practical experience.

• At least one relevant professional certification such as PMP, CISSP, CISA, CISM, CRISC, CGRC, or ISO 27001 Lead Auditor.

🏝️ Benefits

• Medical, Dental & Vision (including domestic partnerships).

• Employer Paid Life Insurance & Employee/Spouse/Child Supplemental life.

• Voluntary Short/Long Term Disability Insurance.

• 401K (Roth/Traditional).

• A generous PTO plan that acknowledges your commitment and seniority (including paid Bereavement/Jury Duty, etc.).

• Above-market annual bonuses.