GRC Program Manager - Remote

Velera is the nation’s premier payments credit union service organization (CUSO) and an integrated fintech solutions provider. The company serves more than 4,000 financial institutions throughout North America, operating with velocity to help our clients keep pace with the rapid momentum of change and fuel growth in the new era of financial services. Our purpose: We accelerate partners’ success through innovative financial technology solutions and inspired service.

The GRC (Governance, Risk, & Compliance) Program Manager plays a critical role in ensuring the company adheres to applicable cyber laws, regulations and information security policies and standards. The individual will design, implement, and govern cyber risk management and technology compliance activities, collectively as a program.The individual will be responsible for the implementation and optimization of a governance, risk and compliance tool with execution of one or more cyber risk management programs, to include user attestations, third-party risk management, cyber contract administration, IT control testing, and audit coordination. Program functions and duties may include: planning, scheduling, and oversight of internal/external system user attestations across the enterprise; assessing and consulting on third-party cyber risks; review and negotiation of cyber contracts; coordination of IT components of onsite and virtual audits/assessments (e.g., SOC1/2, PCI DSS/NIST CSF, NIST AI RMF), NCUA regulatory examinations and client due diligence reviews. The individual must scope and execute program(s) to ensure the organization meets regulatory requirements and industry standards to mitigate cyber risks and achieve company certification and reporting objectives (e.g., PCI DSS, NIST, SOC1/2).This is an individual contributor role reporting to the VP of Technology Compliance and engaging with internal and external stakeholders to mitigate risk, integrate security measures into business operations, and foster a security-conscious culture.

• Define program goals, measurable objectives and governance framework
• Design, scope, and execute program(s) to achieve stated objectives in alignment with business strategies and priorities
• Perform program functions and duties that may include: planning, scheduling, and oversight of   internal/external system user attestations across the enterprise; assessing and consulting on third-party cyber risks; review and negotiation of cyber contracts; coordination of IT components of onsite and virtual audits/assessments (e.g., SOC1/2, PCI DSS/NIST CSF), NCUA regulatory examinations and client due diligence reviews.
• Implement and execute assigned program(s) through the use of a GRC tool and in accordance with company reporting and certification deadlines (e.g., PCI DSS, NIST CSF, SOC1/2)
• Gain support and buy-in by educating employees about program objectives, controls, and their responsibilities in mitigating cyber risks
• Lead and manage cyber risk management and technology compliance initiatives
• Interpret and translate cybersecurity and compliance requirements into program design
• Proactively identify and monitor emerging cybersecurity threats and regulatory landscape; adapt program design, scope, and execution to mitigate risks and comply with new regulation
• Collaborate and partner with cross-functional business and technology stakeholders at all levels to ensure program objectives are met; work with internal/external auditors, vendors, and clients as required
• Monitor and assess program governance and effectiveness (e.g., QA reviews, control testing)
• Define and report on KPIs
• Identify and implement process improvements to drive program efficiencies, minimize impact to business operations, and enhance user experiences; incorporate Inspired Service elements into program design where possible
• Perform all other duties as assigned.

• Eight (8) years of relevant experience in cyber GRC, technology controls consulting, PCI/NIST CSF assessments, IT internal/external auditing, or cyber risk management.
• At least five (5) years in a GRC program manager or equivalent role identifying, assessing, and mitigating information security, technology compliance, and cyber risks.
• Implementation of GRC tool (Optro, Vanta, Drata, OneTrust) and control automation required
• Experience in Financial Services, Fintech, SaaS environments highly preferred.

About Velera

At Velera, inclusion isn’t an initiative – it’s how we work. Guided by a people‑helping‑people philosophy, we cultivate a culture where every employee feels valued, respected and empowered to do their best work. We’re committed to building a diverse workforce and fostering meaningful connection across our teams. Through a remote‑first, flexible environment, we prioritize psychological safety, wellbeing and belonging so individuals and teams can collaborate to thrive. Together, we’re shaping a new era of secure, innovative solutions for the clients and communities we serve. Learn more about what it’s like to work at Velera.

Pay Equity

Actual Pay will be adjusted based on experience and other job-related factors permitted by law.

Great Work/Life Benefits!

• Competitive wages

• Medical with telemedicine

• Dental and Vision

• Basic and Optional Life Insurance

• Paid Time Off (PTO)

• Maternity, Parental, Family Care

• Community Volunteer Time Off

• 12 Paid Holidays

• Company Paid Disability Insurance

• 401k (with employer match)

• Health Savings Accounts (HSA) with company provided contributions

• Flexible Spending Accounts (FSA)

• Supplemental Insurance

• Mental Health and Well-being: Employee Assistance Program (EAP)

• Tuition Reimbursement

• Wellness program

• Benefits are subject to generally applicable eligibility, waiting period, contribution, and other requirements and conditions

Velera is an Equal Opportunity Employer. We consider applicants without regard to race, color, religion, age, national origin, ancestry, ethnicity, gender, gender identity, gender expression, sexual orientation, marital status, veteran status, disability, genetic information, citizenship status, or membership in any other group protected by federal, state or local law.

Velera is an Equal Opportunity Employer that complies with the laws and regulations set forth in the following "EEO is the Law" Poster. Velera will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. However, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the legal duty to furnish information.

Velera is an E-Verify Employer. Review the E-Verify Poster here.  For information regarding your Right To Work, please click here.

This role is currently not eligible for sponsorship.

As an ongoing commitment to reasonably accommodate individuals with disabilities please contact a recruiter at [email protected] for assistance.