GRC Manager Jobs
GRC Manager jobs are open across financial services, healthcare, technology, and government contracting, at every level from early-career analyst promotions to senior and director, with specializations in regulatory compliance, risk frameworks, and audit program management. Find a role that fits below and apply directly.
Find GRC Manager JobsOverview
Showing 5 of 30+ GRC Manager jobs
Nice to meet you!
We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.
We’re also a debt-free multi-billion-dollar organization on our path to IPO-readiness. If you're looking for a dynamic, fulfilling career coupled with flexibility and world-class employee experience, you'll find it here.
About the job
We’re looking for an IT Auditor - Program Manager, GRC - A, that will help conduct audits to ensure internal controls are in place that align with various regulations (which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53) as well as the policies and procedures set forth by SAS. A secondary focus is to operate in a compliance role, assist in the risk program, and facilitating remediation of continuous improvement efforts across the business.
As an IT Auditor - Program Manager, you will:
- Lead internal audits by:
- Benchmarking of security policies against best practices and standards, which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53.
- Creating and executing on audit test cases and managing work papers and evidence
- Developing and presenting Audit Reports
- Lead efforts to formalize and mature the Audit Program at SAS
- Use the ServiceNow IRM tool to create and manage continuous monitoring indicators, build reporting dashboards, document electronic work papers, and manage audit documentation
- Perform issue remediation tasks such as analysis, documentation, follow-up and retesting in response to audit findings.
- Operate as a consultant, researching and recommending changes to enhance or streamline quality and information security procedures, including internal and external auditing.
- Review hosting, security, and audit contract terms and ensure compliance to current policies and processes.
- Help maintain the IT and security policy and process development and updates, while ensuring compliance with regulatory regulations and guidance.
- Assist in conducting Risk Assessments, including participation in risk workshops with subject matter experts where vulnerabilities and threats are discussed in association with likelihood and probability factors.
- Coordinate response to complete RFP and security questionnaires.
- Perform other duties, as assigned.
Required Qualifications
- Bachelor's degree in Business, IT, Computer Science or related field
- 5-8 years of experience in an audit, compliance, risk or governance-related functions
- Knowledge of Risk-based auditing methodologies and audit procedures
- Auditor certification strongly preferred, such as CISA
- Must have the ability to work with little supervision, escalating issues, as appropriate
- US Citizenship required
- You’re curious, passionate, authentic and accountable. These are our values and influence everything we do.
Preferred Qualifications
- Understanding of best practices for information security and data privacy
- Knowledge and experience with best practices /standards: ISO 27001, ITIL, or COBIT
- Understanding of regulatory standards: PCI, FISMA/NIST 800-53, or IRS 1075
- Experience with a GRC System and Electronic Workpapers
- Experience with ServiceNow issue management ticketing system (Preferably IRM)
- SAS software implementation experience or prior implementation experience
- Knowledge of IT, project management, compliance or quality auditor procedures and tools (not financial/accounting)
- IT hosting experience
- Comprehensive medical, prescription, dental and vision plans.
-
Medical plan options include:
- PPO with low annual deductible and copays.
- HDHP combined with a health savings account with a contribution from SAS (no access to on-site health care center).
- Onsite Health Care Center (HQ) that’s free to employees and family members enrolled in the PPO plan. There's a pharmacy too! Not local to HQ? The pharmacy will ship prescriptions for no additional charge!
- An industry-leading 401k plan.
- Tuition Assistance Program and programs and resources to support your development
- Generous time away including vacation time, a variety of paid holidays, and our much-loved U.S. Winter Wellness Break between December 25 and January 1.
- Volunteer Time Off, parental leave and unlimited paid sick days.
- Generous childcare benefits for all full-time employees.
You are welcome here.
Additional Information:
Resumes may be considered in the order they are received. SAS employees performing certain job functions may require access to technology or software subject to export or import regulations. To comply with these regulations, SAS may obtain nationality or citizenship information from applicants for employment. SAS collects this information solely for trade law compliance purposes and does not use it to discriminate unfairly in the hiring process.
SAS only sends emails from verified “sas.com” email addresses and never asks for sensitive, personal information or money. If you have any doubts about the authenticity of any type of communication from, or on behalf of SAS, please contact Recruitingsupport@sas.com.
Let's stay in touch! Join our Talent Community to stay up to date on company news, job updates and more.
Nice to meet you!
We’re a leader in data and AI. Through our software and services, we inspire customers around the world to transform data into intelligence - and questions into answers.
We’re also a debt-free multi-billion-dollar organization on our path to IPO-readiness. If you're looking for a dynamic, fulfilling career coupled with flexibility and world-class employee experience, you'll find it here.
About the job
We’re looking for an IT Auditor - Program Manager, GRC - A, that will help conduct audits to ensure internal controls are in place that align with various regulations (which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53) as well as the policies and procedures set forth by SAS. A secondary focus is to operate in a compliance role, assist in the risk program, and facilitating remediation of continuous improvement efforts across the business.
As an IT Auditor - Program Manager, you will:
- Lead internal audits by:
- Benchmarking of security policies against best practices and standards, which may include ISO 27001, PCI, FISMA, IRS 1075, and NIST 800-53.
- Creating and executing on audit test cases and managing work papers and evidence
- Developing and presenting Audit Reports
- Lead efforts to formalize and mature the Audit Program at SAS
- Use the ServiceNow IRM tool to create and manage continuous monitoring indicators, build reporting dashboards, document electronic work papers, and manage audit documentation
- Perform issue remediation tasks such as analysis, documentation, follow-up and retesting in response to audit findings.
- Operate as a consultant, researching and recommending changes to enhance or streamline quality and information security procedures, including internal and external auditing.
- Review hosting, security, and audit contract terms and ensure compliance to current policies and processes.
- Help maintain the IT and security policy and process development and updates, while ensuring compliance with regulatory regulations and guidance.
- Assist in conducting Risk Assessments, including participation in risk workshops with subject matter experts where vulnerabilities and threats are discussed in association with likelihood and probability factors.
- Coordinate response to complete RFP and security questionnaires.
- Perform other duties, as assigned.
Required Qualifications
- Bachelor's degree in Business, IT, Computer Science or related field
- 5-8 years of experience in an audit, compliance, risk or governance-related functions
- Knowledge of Risk-based auditing methodologies and audit procedures
- Auditor certification strongly preferred, such as CISA
- Must have the ability to work with little supervision, escalating issues, as appropriate
- US Citizenship required
- You’re curious, passionate, authentic and accountable. These are our values and influence everything we do.
Preferred Qualifications
- Understanding of best practices for information security and data privacy
- Knowledge and experience with best practices /standards: ISO 27001, ITIL, or COBIT
- Understanding of regulatory standards: PCI, FISMA/NIST 800-53, or IRS 1075
- Experience with a GRC System and Electronic Workpapers
- Experience with ServiceNow issue management ticketing system (Preferably IRM)
- SAS software implementation experience or prior implementation experience
- Knowledge of IT, project management, compliance or quality auditor procedures and tools (not financial/accounting)
- IT hosting experience
- Comprehensive medical, prescription, dental and vision plans.
-
Medical plan options include:
- PPO with low annual deductible and copays.
- HDHP combined with a health savings account with a contribution from SAS (no access to on-site health care center).
- Onsite Health Care Center (HQ) that’s free to employees and family members enrolled in the PPO plan. There's a pharmacy too! Not local to HQ? The pharmacy will ship prescriptions for no additional charge!
- An industry-leading 401k plan.
- Tuition Assistance Program and programs and resources to support your development
- Generous time away including vacation time, a variety of paid holidays, and our much-loved U.S. Winter Wellness Break between December 25 and January 1.
- Volunteer Time Off, parental leave and unlimited paid sick days.
- Generous childcare benefits for all full-time employees.
You are welcome here.
Additional Information:
Resumes may be considered in the order they are received. SAS employees performing certain job functions may require access to technology or software subject to export or import regulations. To comply with these regulations, SAS may obtain nationality or citizenship information from applicants for employment. SAS collects this information solely for trade law compliance purposes and does not use it to discriminate unfairly in the hiring process.
SAS only sends emails from verified “sas.com” email addresses and never asks for sensitive, personal information or money. If you have any doubts about the authenticity of any type of communication from, or on behalf of SAS, please contact Recruitingsupport@sas.com.
Let's stay in touch! Join our Talent Community to stay up to date on company news, job updates and more.
GRC Manager Jobs by Experience Level
See All 30 GRC Manager Jobs
Find roles that match your experience and apply in just a few clicks.
Find GRC Manager JobsGRC Manager Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Science & Research
- Banking & Financial Services
What Employers Look For
The qualifications that appear most often in GRC manager jobs.
- Five or more years of experience in risk management, compliance, or internal audit
- Hands-on experience with frameworks such as NIST CSF, ISO 27001, SOX, or PCI-DSS
- Proficiency with GRC platforms such as Archer, ServiceNow GRC, or OneTrust
- CISA, CRISC, CISSP, or equivalent professional certification preferred or required
- Bachelor's degree in information security, computer science, business, or a related field
- Demonstrated ability to lead cross-functional risk assessments and communicate findings to executive stakeholders
Tips for Your GRC Manager Job Search
Align your resume to specific frameworks
GRC managers are hired for framework fluency, so your resume must name the ones you've actually operated: NIST CSF, ISO 27001, SOX, HIPAA, PCI-DSS. Generic 'compliance experience' won't pass the initial screen at most companies with mature programs.
Lead with audit metrics, not duties
Hiring managers for grc manager roles skim for evidence of scope and impact. Replace duty-list bullets with outcomes: controls tested per cycle, findings remediated, audit cycle shortened. Numbers give reviewers something concrete to anchor your candidacy.
Filter openings by the right certification signals
Job postings for grc managers often list CISA, CRISC, or CISSP as preferred rather than required. Prioritize roles where your current certifications match the preferred column, not just the minimum, to improve your odds of moving past the initial screen.
Apply early to roles that fit
Migrate Mate lists grc manager openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Prepare for a technical risk scenario round
Many grc manager interviews include a live scenario where you're handed a control gap or audit finding and asked to walk through remediation. Practice narrating your reasoning aloud, because interviewers are evaluating your process, not just your conclusion.
Negotiate scope before discussing compensation
GRC manager offers vary significantly based on program ownership, team size, and reporting line. Clarify whether the role owns the full GRC program or supports a larger function before negotiating, so your compensation ask reflects the actual decision-making authority.
GRC Manager Jobs: Frequently Asked Questions
Which companies are hiring the most grc managers?
The companies hiring the most grc managers right now include Whoop, OpenAI, and Workiva, with the largest share of openings in California, Illinois, and New York, based on current listings on Migrate Mate as of November 2026. Financial services, healthcare systems, and large technology firms consistently account for the greatest volume of grc manager openings.
How many grc manager jobs are remote?
About 81% of grc manager openings are fully remote or hybrid as of November 2026, reflecting broader trends in compliance and risk roles that do not require physical presence. Policy development, vendor risk assessments, and GRC platform administration tend to be the sub-areas most commonly offered as fully remote arrangements.
How do you become a grc manager?
Start in an entry-level compliance, audit, or IT risk analyst role to build hands-on exposure to control testing and regulatory requirements. Earn a recognized certification such as CISA or CRISC to signal framework competence. Take on progressively larger audit cycles or risk assessments, then move into a team lead or program coordinator role before targeting manager-level postings.
Can you get hired as a grc manager with little experience?
Moving directly into a grc manager title with no prior compliance or risk experience is uncommon, but candidates who have led audit engagements, managed a controls library, or owned a regulatory remediation project in a non-manager role do make the transition. Demonstrating that you've owned a program outcome, even without the manager title, carries more weight than years alone.
What does the grc manager interview process look like?
Most grc manager interviews run three to four rounds. The first is typically a recruiter screen focused on background and framework experience. A hiring manager conversation follows, covering program ownership and cross-functional communication. Many processes then include a technical or scenario-based round where you work through a risk or control gap in real time, followed by a final round with senior leadership or the CISO.
Where can I find and apply to grc manager jobs?
You can find and apply to grc manager jobs on Migrate Mate, which lists current openings from companies across the United States. Find roles that match your experience and certifications, then apply directly to each listing from the page.
See All 30 GRC Manager Jobs
Find roles that match your experience and apply in just a few clicks.
Find GRC Manager Jobs