Senior Manager, Security Awareness & GRC (AI Governance)

Location: Remote within the United States, with mandatory in-person onboarding at headquarters once per quarter.

Salary: $120,500–$157,000 per year, plus performance-based incentives and benefits.

Company

Healthcare financial services organization focused on empowering consumers to manage healthcare spending and improve their lives.

What you will do

• Own the enterprise security awareness, human risk management, and security culture strategy.
• Design and improve behavior-focused campaigns covering phishing, fraud, privacy, AI governance, cybersecurity awareness, and emerging threats.
• Lead phishing simulations, targeted learning, onboarding education, reporting workflows, and reinforcement communications.
• Develop program metrics, KPIs, evaluations, and executive reporting to measure behavior change, control effectiveness, and risk reduction.
• Partner with Security, GRC, Fraud, Privacy, Legal, HR, Marketing, Product Security, IT, and executive leadership.
• Manage vendors and mentor security awareness specialists while supporting risk assessments, incident education, and scalable security technologies.

Requirements

• 7+ years of experience in security awareness, human risk management, information security GRC, compliance, audit, privacy, communications, change management, or enterprise program leadership.
• Experience leading enterprise security awareness, human risk management, or security culture programs in a regulated environment.
• Strong ability to translate technical, regulatory, privacy, fraud, compliance, and AI governance concepts into clear communications and training.
• Experience with behavior-focused campaigns, phishing simulation data, training metrics, newsletters, videos, intranet content, and stakeholder communications.
• Knowledge of at least one applicable standard or framework, such as SOC 1, SOC 2 Type II, ISO/IEC 27001, HIPAA, HITRUST, or PCI DSS.
• CompTIA CySA or comparable certification; a bachelor's degree and certifications such as CIPP, CIPM, CDPSE, CISSP, CISM, CISA, or CCSA are preferred.

Nice to have

• Experience in a technology setting or highly regulated industry.
• Additional security, privacy, audit, or compliance certifications.

Culture & Benefits

• Remote work within the United States with required quarterly onsite onboarding at headquarters; travel and accommodations are covered.
• Medical, dental, and vision coverage.
• HSA contribution and match, dependent care FSA match, and 401(k) match.
• Uncapped paid time off and paid parental leave.
• Education and tuition assistance, fitness reimbursement, wellness incentives, and financial literacy programs.

Hiring process

• Screening interviews may be transcribed with Microsoft Copilot, with an option to opt out.
• Live interviews and assessments must reflect the candidate's own work and thinking unless AI use is explicitly approved.