Remote Sr GRC & Compliance Manager; CST & EST

Location: Remote Compensation: $125,000 - $150,000 DOE (exempt/annual salary)

For over 50 years, Transworld Systems, Inc. has been a leader in providing business process outsourcing services, including accounts receivable management, customer relationship management, and back-office services to a diverse customer base. Our 60,000 clients benefit from our ability to help them address immediate business needs while fostering long-term growth throughout the customer lifecycle.

• Team-oriented work environment
• Growth opportunity
• Comprehensive benefits package available: including medical, dental and vision, 401k retirement plan with employer matching, paid time off and paid holidays!

Transworld Systems Inc. is seeking a Senior GRC & Compliance Manager to own and operate the company’s security compliance program. This role will provide day-to-day ownership of external audits, control management, evidence collection, remediation tracking, and coordination with control owners and auditors. The objective is to move compliance from an annual audit project to a repeatable, year-round program.

The initial priority for this role is execution of the current PCI audit cycle and establishment of an AI Governance program. The resource will immediately establish controls and ownership, coordinate evidence collection, identify readiness gaps, drive remediation, and manage auditor requests through fieldwork and report completion.

• Lead operational execution for SOC 2, ISO 27001, HITRUST, FISMA, HIPAA, and PCI-DSS compliance activities across the organization.
• Own day-to-day execution of the Security and AI Risk & Governance programs.
• Maintain a consolidated mapping of audit requirements and controls across in-scope business units and reports.
• Assign and maintain clear control ownership across business, technology, security, HR, finance, and other stakeholder groups.

• Work directly with control owners to collect, review, organize, and validate audit evidence before submission.
• Coordinate evidence requests, samples, follow-up questions, and status updates with external auditors.
• Identify control or evidence gaps and drive remediation plans with accountable owners, target dates, and escalation paths.
• Track audit readiness, open items, exceptions, dependencies, and risks; provide regular reporting to security and technology leadership.

• Maintain policies, standards, control narratives, system descriptions, and other compliance documentation.
• Establish an annual compliance calendar so controls and evidence are managed throughout the year rather than only during audit periods.
• Develop recurring control testing and evidence validation processes to identify issues before external audit fieldwork.
• Support additional regulatory, customer, and security compliance requirements as the program evolves.
• Partner with Security, IT, Legal, HR, Finance, Internal Audit, and business teams to improve control maturity and accountability.

• PCI scope is mapped to applicable controls, requirements, and accountable owners.
• A centralized risk register is established, with risks mapped to accountable owners.
• Evidence requests are tracked centrally with clear status, due dates, and escalation paths.
• Control and evidence gaps are identified early, and remediation begins before the audit window.
• Auditor requests and follow-ups are managed through a single accountable program owner.
• Leadership has clear visibility into audit status, risks, blockers, and required decisions.
• Following the PCI audit, a year-round compliance operating model and calendar are established for the next cycle.

• Security, risk, and compliance expertise: 5+ years of experience in information security governance, risk, compliance, audit, or a related discipline.
• Audit management: Hands-on experience managing SOC 2 or comparable security audits, including control mapping, evidence collection, auditor coordination, and remediation.
• Control knowledge: Strong understanding of security and IT controls across identity and access management, change management, vulnerability management, incident response, logging and monitoring, backup and recovery, third-party risk, and security governance.
• Cross-functional coordination: Experience…