LOCATION: Remote

REPORTS TO: Corporate Counsel

The GRC Manager will operate at the intersection of Legal, IT, Security, and Business Operations, serving as a central point of coordination for governance, risk, and compliance initiatives across the organization. The Governance, Risk & Compliance Manager will work closely with Corporate Counsel to align compliance strategy with regulatory obligations and legal risk considerations.

The GRC Manager partners heavily with IT and Information Security teams to translate technical controls and security frameworks into business-aligned processes and documentation. Collaboration with Product and Engineering may be required to ensure that data handling, system controls, and security practices align with compliance requirements.

In addition, the position supports client-facing teams including Sales, Account Management, and Customer Success by responding to due diligence requests, security questionnaires, and audit inquiries, helping to build trust with lender clients and external stakeholders. The role will also coordinate with Operations and Data functions, to support data quality auditing and integrity initiatives.

Externally, the GRC Manager will interact with third-party auditors, vendors, and client stakeholders to support audits, vendor risk management, and compliance assurance activities.

THE OPPORTUNITY: The GRC Manager will mature and scale the company’s GRC capabilities during a period of growth. This role offers the opportunity to build structure, drive process improvements, and enhance the company’s compliance posture in a highly regulated environment.

The position plays a critical role in establishing and maintaining audit readiness (including SOC 2 Type II), strengthening vendor risk management practices, and improving the efficiency and quality of client-facing due diligence responses. The individual will help translate evolving regulatory and security requirements into actionable, business-aligned controls that support both internal operations and external trust.

This is a highly cross-functional and visible role with the opportunity to influence how compliance, risk, and security practices are operationalized across the organization. The ideal candidate will bring both strategic thinking and hands-on execution, helping F&I Sentinel continue to build credibility with financial institution partners while supporting scalable, sustainable growth.

Specifically, the GRC Manager will have responsibility in:

Audit & Certification

Drive SOC 2 Type II audit readiness end-to-end: evidence collection, auditor coordination, and remediation tracking

Execute internal audit procedures across operations for accuracy, completeness, and compliance

Document audit findings, develop corrective action plans, and track remediation to closure

Maintain GRC documentation including control narratives, procedures, and supporting artifacts for continuous audit readiness

Support BCP, DR, and IR programs, including tabletop exercises and plan testing

Due Diligence & Security Questionnaire Management

Own and optimize the end-to-end Due Diligence Questionnaire (DDQ) response workflow, drafting, reviewing, and delivering responses to security questionnaires, Request For Proposals (RFP), and vendor assessments that build trust with lender clients

Partner with IT, infosec, operations, and leadership to serve as the liaison between technical teams and client-facing engagements

Exercise sound judgment in determining how to frame sensitive topics and how to present the company’s security posture accurately

Develop efficiencies through process improvements, implementation of automation and tools, and standardizing responses

Vendor Risk Management

Manage and continuously improve the vendor risk program, maintaining a current inventory of third-party providers with data access or critical dependencies

Apply and refine risk tiering based on data sensitivity, business impact, and regulatory exposure

Conduct periodic reviews of critical and high-risk vendors; track remediation of findings and ensure contractual compliance

Maintain vendor risk documentation that supports audit readiness and DDQ responses

Risk Management Support

Assist in maintaining the risk register; identify emerging risks and document mitigating controls

Assist with risk assessments; operationalize mitigation strategies and validate controls

Data Quality Auditing

Partner with the Data Analyst to define data quality audit criteria and compliance-focused reporting requirements

Review data quality results for accuracy and completeness; identify and escalate data integrity issues

Design data checks and guardrails that ensure operational data integrity across products

Professional Qualifications:

The following knowledge, skills, education, and experiences are required:

3–6+ years of professional working experience

Hands-on experience with SOC 2 audits, either managing or as a key contributor

Working knowledge of security frameworks such as NIST CSF, ISO 27001, FTC Safeguards Rule, or similar

Proven ability to draft and manage security questionnaire responses for enterprise clients

Strong written communication skills - you will be writing client-facing materials that reflect the company's professionalism

Ability to operate independently, manage multiple workstreams, and escalate appropriately

Comfort working in a fully remote environment with a distributed team

The following knowledge, skills, and experiences are preferred, but not required:

Experience in fintech, insurtech, automotive finance, or another regulated industry

Familiarity with F&I (Finance & Insurance) products or the automotive dealer ecosystem is a strong plus

Exposure to vendor/third-party risk management programs

Understanding of basic data privacy requirements (CCPA, state privacy laws)

Experience with data quality analysis and reporting tools

Bachelor's degree in Information Systems, Business, Accounting, Risk Management, or a related field; relevant certifications such as CISA, CRISC, or GRCP are a plus

Why Consider Joining FIS now?

The business is poised for accelerated growth with increasing demand from financial institutions and regulatory scrutiny creating a strong need for scalable GRC capabilities

Opportunity to build and shape foundational GRC processes and programs, rather than inherit a fully mature system

High visibility role with direct impact on client trust, audit outcomes, and enterprise risk posture

Exposure to a unique intersection of fintech, automotive finance, and regulatory compliance

Collaborative, cross-functional environment with access to leadership and influence on strategic decisions

Hybrid/remote culture offering flexibility and autonomy

Competitive compensation and benefits, with opportunity for growth as the company scales

The following behaviors are required:

Ownership mindset: takes full accountability for outcomes, follows through, and proactively addresses gaps

Detail-oriented and quality-driven: maintains high standards for documentation, accuracy, and audit readiness

Sound judgment and discretion: handles sensitive security and compliance information appropriately

Strong written communicator: translates complex technical and regulatory concepts into clear, client-ready language

Cross-functional collaborator: builds trust and works effectively across Legal, IT, Security, and business teams

Process-oriented and disciplined: creates repeatable, scalable workflows and continuously improves them

Risk-aware and pragmatic: balances regulatory requirements with business practicality and speed

Self-directed and organized: manages multiple priorities independently in a remote environment

Continuous learner: stays current on evolving regulations, frameworks, and industry best practices

Problem-solver: identifies root causes, proposes solutions, and drives issues to resolution

Client-focused: understands the importance of external trust and represents the company professionally in due diligence interactions

Adaptable and resilient: operates effectively in a growing, evolving organization with shifting priorities.

F&I Sentinel is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national origin, gender, sexual orientation, gender identity, age, physical or mental disability, genetic factors, military/veteran status, or other characteristics protected by law.