Remote Sr GRC & Compliance Manager (CST & EST considered)

Location: Remote
Compensation:  $125,000 - $150,000 DOE (exempt/annual salary)

For over 50 years, Transworld Systems, Inc. has been a leader in providing business process outsourcing services, including accounts receivable management, customer relationship management, and back-office services to a diverse customer base. Our 60,000 clients benefit from our ability to help them address immediate business needs while fostering long-term growth throughout the customer lifecycle.

Why should you consider TSI (part of TSI family of companies)?

• Team-oriented work environment
• Growth opportunity
• Comprehensive benefits package available: including medical, dental and vision, 401k retirement plan with employer matching, paid time off and paid holidays!

Senior GRC & Compliance Manager  

Transworld Systems Inc. is seeking a Senior GRC & Compliance Manager to own and operate the company’s security compliance program. This role will provide day-to-day ownership of external audits, control management, evidence collection, remediation tracking, and coordination with control owners and auditors. The objective is to move compliance from an annual audit project to a repeatable, year-round program.  

The initial priority for this role is execution of the current PCI audit cycle and establishment of an AI Governance program. The resource will immediately establish controls and ownership, coordinate evidence collection, identify readiness gaps, drive remediation, and manage auditor requests through fieldwork and report completion.  

Compliance Program Ownership

• Lead operational execution for SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS compliance activities across the organization.
• Own day-to-day execution of the Security and AI Risk & Governance programs.
• Maintain a consolidated mapping of audit requirements and controls across in-scope business units and reports.
• Assign and maintain clear control ownership across business, technology, security, HR, finance, and other stakeholder groups.

Audit Execution and Evidence Management

• Work directly with control owners to collect, review, organize, and validate audit evidence before submission.
• Coordinate evidence requests, samples, follow-up questions, and status updates with external auditors.
• Identify control or evidence gaps and drive remediation plans with accountable owners, target dates, and escalation paths.
• Track audit readiness, open items, exceptions, dependencies, and risks; provide regular reporting to security and technology leadership.

Governance, Documentation, and Continuous Improvement

• Maintain policies, standards, control narratives, system descriptions, and other compliance documentation.
• Establish an annual compliance calendar so controls and evidence are managed throughout the year rather than only during audit periods.
• Develop recurring control testing and evidence validation processes to identify issues before external audit fieldwork.
• Support additional regulatory, customer, and security compliance requirements as the program evolves.
• Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to improve control maturity and accountability.

Near-Term Success Measures

• PCI scope is mapped to applicable controls, requirements, and accountable owners.
• A centralized risk register is established, with risks mapped to accountable owners.
• Evidence requests are tracked centrally with clear status, due dates, and escalation paths.
• Control and evidence gaps are identified early, and remediation begins before the audit window.
• Auditor requests and follow-ups are managed through a single accountable program owner.
• Leadership has clear visibility into audit status, risks, blockers, and required decisions.
• Following the PCI audit, a year-round compliance operating model and calendar are established for the next cycle.

Required Qualifications

• Security, risk, and compliance expertise: 5+ years of experience in information security governance, risk, compliance, audit, or a related discipline.
• Audit management: Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection, auditor coordination, and remediation.
• Control knowledge: Strong understanding of security and IT controls across identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance.
• Cross-functional coordination: Experience coordinating control activities across technical and business teams.
• Evidence review: Ability to critically evaluate evidence and determine whether it shows that a control operated as expected.
• Program management: Strong project and program management skills, including the ability to manage deadlines, dependencies, and escalations.
• Communication: Ability to explain audit and compliance issues clearly to both technical teams and executive leadership.

Preferred Qualifications

• Enterprise compliance experience: Experience operating compliance programs across multiple entities or business units.
• GRC and evidence management tools: Experience using GRC or audit management platforms and maintaining structured evidence repositories.
• Security framework knowledge: Familiarity with complementary security frameworks, such as NIST CSF, CIS Controls, ISO 27001, or similar standards.
• Professional certifications: Relevant certifications, such as CISA, CISM, CRISC, CISSP, or equivalent experience.

Work conditions:

The work environment characteristics described here are representative of those an employee encounters while performing the essential functions of this job. You are acknowledging that you can perform the essential functions with or without a reasonable accommodation. The noise level in the work environment is usually moderately quiet. This position primarily operates in an office or remote work environment and requires prolonged periods of sitting and working at a computer. Occasional after-hours support may be required to support production implementations or critical system issues.

This job description is not an exclusive or exhaustive list of all job functions that a team member in this position may be asked to perform. Duties and responsibilities can be changed, expanded, reduced, or delegated by management to meet the business needs of the company.

We provide Equal Employment Opportunity for all individuals regardless of race, color, religion, gender, age, national origin, marital status, sexual orientation, status as a protected veteran, genetic information, status as a qualified individual with a disability and any other basis protected by federal, state or local laws.