Senior Security Compliance Lead — Hybrid

Become an everyday champion — and build a career where your impact fuels financial progress.

What We Do Card Works  Financial Group is a diversified financial services platform building ethical solutions across credit, lending, and the full customer lifecycle. Through our family of companies, Card Works Financial Group tackles the complex challenges that larger financial institutions leave behind. We’re embedded throughout the credit card ecosystem as a lender, servicer, and merchant acquirer.

Who We Are Merrick Bank:
The bank that builds

CardWorks Servicing:
One partner, total performance

Carson Smithfield:
Resolution with respect

With nearly 40 years of operating history, our track record is solid: disciplined in downturns and built to accelerate in recovery. The Card Works Financial Group companies take precise approach in complex markets, as a top three non-prime focused general purpose card issuer and a top fifteen U.S. merchant acquirer.

Our team tackles the industry’s most complex credit and payment challenges. And we believe that excellent work starts with a team that feels supported, respected, and empowered to grow.

Card Works Servicing, LLC provides end-to end operational servicing functions for credit cards, secured cards, and installment loans. We service consumer and small business loans across the credit spectrum and offers backup servicing and due diligence services to capital providers and trustees.

Founded in 1997, Merrick Bank is an FDIC-insured financial institution headquartered in South Jordan, Utah, with over $10 billion in assets. A wholly owned subsidiary of Card Works Financial Group, Merrick Bank serves roughly five million card members and more than 100,000 merchant customers, offering credit cards, recreational loans, deposit accounts, merchant services and bank sponsor ships to consumers and businesses.

Carson Smithfield, LLC provides a variety of post-charge-off debt recovery services, including digital self-service, IVR, live agent, and external agency management.

Position Summary:

The Security Compliance Manager is an individual contributor responsible for operationalizing, executing, and maturing the enterprise security compliance program. This role reports to the Director of Security Risk & Compliance and ensures that the organization’s security compliance strategy is translated into effective operational processes, assessments, and workflows. Core responsibilities include managing compliance operations, executing assessments, reviewing controls, supporting audit readiness, coordinating documentation and evidence, and ensuring accuracy and consistency across compliance systems and reporting.

Essential Functions:

Compliance Program Execution Execute and continuously improve enterprise security compliance processes and assessments, supporting the strategic direction established by the Manager.

Operate and maintain the security compliance technology platform, ensuring assessments, evidence collection, and issue tracking are completed accurately and on schedule.

Coordinate compliance assessment activities and ensure required documentation is complete and aligned with standards.

Create, manage, and maintain standardized templates, procedures, workflows, and reporting to support consistent compliance operations.

Security Exception Management Execute detailed assessments of security exception requests, documenting risks, mitigating controls, approvals, and expiration tracking, in accordance with governance defined by the Director.

Track exception approvals, expirations, and remediation requirements, ensuring timely reminders, escalations, and accuracy of exception data.

Security Issue Escalation & Tracking Manage execution of the Security Compliance Finding and Issue Escalation process, ensuring control gaps and audit findings are documented, monitored, and remediated on schedule.

Maintain and operationalize workflow steps aligned to governance requirements defined by the Director, ensuring appropriate escalation of overdue or high‑risk issues.

Align information security issue tracking with Enterprise Risk Management processes and escalate high‑risk issues through established…