Description:

The Assurance, Risk, and Compliance (“ARC”) Initiatives team at MongoDB owns the strategy, governance, and delivery of our most critical cross-functional risk and compliance initiatives. We design and execute programs that support compliance audits, risk assessments, employee awareness and enablement, and the implementation of common control frameworks, along with consistent operating cadences that align key stakeholders, accelerate decision making, and drive the execution of initiatives that reinforce MongoDB’s assurance, risk management, and compliance objectives. We define and track key metrics and deliver clear and timely, executive reporting to provide transparency, measure progress, and ensure lasting operational resilience and governance.

We serve as the central coordination point for ARC-wide initiatives, connecting Product, Engineering, Security, and Legal teams around clear priorities, milestones, and outcomes. Our focus is on building scalable governance structures, defining decision-making frameworks, and establishing repeatable ways of working so that complex efforts can be executed consistently across the team.

The Policy Program Manager is a mid-to-senior level individual contributor role responsible for leading the development and operationalization of policies and procedures aligned to established control frameworks. You will drive end-to-end ownership of policy lifecycle management, from drafting and review through implementation and ongoing maintenance, while coordinating inputs across teams to ensure accuracy, consistency, and adoption. Additionally, you will lead documentation standardization efforts, facilitate stakeholder reviews, and perform gap analyses to continuously strengthen and mature our ARC policy framework.

Responsibilities:

• Lead the end-to-end execution of company-wide compliance programs, including the annual security policy and procedure review cycle
• Design and implement scalable frameworks for policy lifecycle management (creation, review, approval, publication, and retirement)
• Establish standards, templates, and governance processes to ensure consistency and clarity across all compliance documentation
• Maintain a centralized, audit-ready repository for policies, procedures, and supporting artifacts
• Act as the primary point of contact for cross-functional teams (HR, Legal, Engineering, Product)
• Drive alignment, gather inputs, and ensure timely completion of policy updates and compliance deliverables
• Ensure policies and procedures align with regulatory, security, and internal control requirements
• Support internal and external audits by maintaining complete, accurate, and accessible documentation
• Translate audit findings and regulatory changes into actionable policy program updates
• Maintain the integrity of project-specific Jira boards and Confluence pages. Ensure all project artifacts are organized, up-to-date, and ready for leadership review or external audit
• Develop and maintain dashboards to report on program health, completion rates, and obstacles. Present status updates and metrics to leadership
• Evaluate existing program workflows and implement improvements to increase efficiency, reduce manual effort, and improve the stakeholder experience

Requirements:

• 5-8 years of program management experience, ideally within an Information Security or high-growth technology environment
• Experience creating and managing policy and procedure programs or governance frameworks
• Deep understanding of security and compliance frameworks (e.g., SOC 2, ISO 27001, PCI DSS, HIPAA, NIST CSF)
• Strong proficiency in managing full-lifecycle projects, including scoping, planning, risk mitigation, and change control
• Advanced experience with Jira and Confluence, including the ability to build custom dashboards and manage complex documentation repositories
• Maintain and support a GRC/policy management platform to ensure consistent policy administration and system usability
• Excellent interpersonal skills with the ability to hold cross-functional stakeholders accountable to deadlines in a professional and effective manner
• Exceptional attention to detail and the ability to manage multiple overlapping priorities without losing sight of milestones
• A proactive, self-directed approach to work. You enjoy taking ownership of a program and building the structure necessary for its success

Responsibilities & Expectations

• You are expected to be the owner of your assigned programs. While you will work closely with technical SMEs, you are responsible for the logistical success of the workstream. Your success is measured by the timely completion of program goals, the clarity of your reporting, and your ability to anticipate and resolve project bottlenecks
• You don't just track tasks; you own the success of the program

Scope & Complexity

• The scope is horizontal and impacts multiple departments across MongoDB
• Managing complex programs that require coordination with various business units, ensuring that project delays in one area do not derail the overall compliance roadmap

Authority & Impact

• You have the authority to manage the timelines and execution steps of your assigned programs
• Your impact is reflected in the strength of policy program management and organizational readiness you drive; by overseeing and coordinating these workstreams, you ensure the Compliance team consistently meets foundational policy requirements and aligns with external audit expectations

Expertise

• You will develop deep expertise in compliance and audit operations
• You will become the go-to resource for designing, scaling, and executing policy and compliance programs within a cloud-first organization. This role is responsible for independently and collaboratively developing and managing policies and procedures, with a strong understanding of compliance frameworks and the ability to interpret and operationalize control requirements

Leadership

• Leadership in this role is demonstrated through influence and mentorship. While you may not have direct reports, you will guide cross-functional teams in developing and standardizing policies/supporting documentation, as well as provide mentorship on policy governance, standardized documentation practices, and compliance alignment

About MongoDB

MongoDB is built for change, empowering our customers and our people to innovate at the speed of the market. We have redefined the database for the AI era, enabling innovators to create, transform, and disrupt industries with software. MongoDB’s unified database platform, the most widely available, globally distributed database on the market, helps organizations modernize legacy workloads, embrace innovation, and unleash AI. Our cloud-native platform, MongoDB Atlas, is the only globally distributed, multi-cloud database and is available across AWS, Google Cloud, and Microsoft Azure.

With offices worldwide and over 60,000 customers, including 75% of the Fortune 100 and AI-native startups, relying on MongoDB for their most important applications, we’re powering the next era of software.

Our compass at MongoDB is our Leadership Commitment, guiding how and why we make decisions, show up for each other, and win. It’s what makes us MongoDB. 

To drive the personal growth and business impact of our employees, we’re committed to developing a supportive and enriching culture for everyone. From employee affinity groups, to fertility assistance and a generous parental leave policy, we value our employees’ wellbeing and want to support them along every step of their professional and personal journeys. Learn more about what it’s like to work at MongoDB, and help us make an impact on the world!

MongoDB is committed to providing any necessary accommodations for individuals with disabilities within our application and interview process. To request an accommodation due to a disability, please inform your recruiter.

MongoDB, Inc. provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type and makes all hiring decisions without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws.

REQ ID: 1273402887

This role requires a hybrid schedule and will be based in our South Charlotte, NC Headquarters (Tuesday through Thursday) and work fully remotely on Mondays and Fridays each week.

Curious how Shared Services fits into Red Ventures? Click here. 

Red Ventures is hiring a Manager, Technical Risk and Compliance to drive risk reduction across our organization and lead meaningful change wherever risk is not tolerable. This is a player-coach role, you will own the program and stay close to the work. This leader will own the technology risk program across multiple lines of business, from identification and prioritization through remediation and reporting, while establishing trusted partnerships and ensuring compliance obligations are met with rigor and consistency. If your compliance experience has been primarily vendor management and status reporting, this is probably not the right fit. This role includes direct people management responsibility, with a team that grows in scope over time.

What You’ll Do:

• Own the end-to-end technology risk lifecycle across all lines of business, including assessment, prioritization, remediation tracking, and executive reporting, ensuring every risk has a clear owner and is tracked to closure.
• Run the exception program, covering intake, review, approval routing, expiration tracking, and renewal governance, with no exceptions aging without an owner or a remediation commitment.
• Own the vendor and third-party risk assessment program, scoping and sequencing assessments based on exposure and business criticality, and embedding vendor risk review into onboarding and renewal cycles with Procurement and Legal.
• Drive compliance posture across PCI, SOC2, ISO 27001, and NYDFS, maintain the full obligation calendar, direct the team on assessments and evidence collection, and ensure no regulatory deadline is a surprise.
• Perform hands-on control testing, not just documentation review, but validating that technical controls are actually working, including logging enablement, encryption enforcement, and access scoping, and knowing when a screenshot is not sufficient evidence.
• Translate regulatory requirements into specific technical configurations and work directly with engineering to close gaps, you can read cloud configurations, IAM policies, and security tool outputs and assess whether a control is actually in place.
• Leverage AI tools and automation to accelerate compliance workflows, from drafting control narratives and risk assessments to streamlining evidence collection, closing audit gaps faster, and reducing manual toil across recurring compliance tasks.
• Assess AI, ML systems, and automated pipelines from a risk and compliance lens, understanding data flows, model governance, and where traditional frameworks require interpretation or adaptation.
• Eliminate the highest-friction manual GRC and compliance processes through tooling and workflow automation, targeting meaningful burden reduction within the first year.
• Serve as the security organization's primary interface to the business, building trusted relationships with BU leaders, Engineering, Finance, Legal, and Compliance, and translating risk into financial exposure, operational disruption, and regulatory consequence.

What We’re Looking For:

• Proven risk program ownership, has built or significantly matured a technology risk lifecycle end-to-end, and has been the one pulling evidence and validating controls, not just managing the auditor relationship.
• Technical compliance depth, 3 or more years in a GRC, compliance, or risk role where you were also the person who could validate the technical fix, not just track it in a spreadsheet.
• Hands-on audit experience, you have owned at least one major framework audit end-to-end, SOC 2 Type II, PCI DSS, or HIPAA, including evidence collection, control testing, and auditor response.
• Multi-stakeholder risk communication, translates technical risk into business impact for non-technical leaders across diverse business units.
• Automation-first mindset, track record of eliminating manual GRC or security processes through tooling, workflow automation, and AI-assisted compliance tasks.
• Cross-functional partnership builder, builds lasting relationships with Engineering, Finance, Legal, and BU leaders to drive risk accountability.
• Security architecture fluency, understands secure design principles, can read and evaluate cloud configurations and IAM policies, and can lead engineers through design reviews and risk mitigation work.
• Operates independently, sets direction, resolves blockers, and escalates only when a true decision is needed.
• AI and emerging tech risk awareness, can assess and advise on risks from AI adoption, automated pipelines, cloud architectures, and third-party integrations.
• People leader who develops talent, actively growing the team toward greater scope and ownership.

Minimum Qualifications: 

• At least 7 years of experience in cybersecurity, technology risk, or security operations.
• Demonstrated experience owning a technology risk program, not just contributing to one.
• Experience leading cross-functional risk assessments across multiple business units or technology domains.
• Strong understanding of risk and control frameworks including NIST, ISO 27001, and FAIR.
• Experience in regulated environments including SOC2, PCI, and NYDFS.
• Proven track record of automating manual security or GRC processes, including use of AI tools for compliance acceleration.
• Ability to assess AI, ML systems, and automated workflows from a risk and compliance perspective, including data flows and model governance.
• Strong stakeholder influence skills, with the ability to lead without authority.
• Experience managing technical and risk teams.

Preferred Qualifications: 

• Multi-business-unit or holding company experience, with familiarity operating in federated environments where risk priorities and technology stacks vary by business unit.
• Hands-on GRC platform experience with ServiceNow GRC, Archer, OneTrust, Drata, Vanta, or similar, including workflow automation and reporting configuration.
• Has designed a vendor risk assessment program from scratch, not just contributed to an existing one.
• Experience building risk dashboards or executive risk briefings that were used to drive business decisions.
• Active certifications such as CISA, CRISC, CCSP, or AWS Security Specialty.
• Prior experience at a company that went through a SOC 2 Type II or PCI Level 1 audit from scratch.
• Background that started in IT, cloud, or security engineering before moving into risk and compliance.
  
  

Compensation: 

This range reflects total cash compensation, which may include base salary only or base salary plus target bonus, depending on the role. Where eligible, equity may also be offered separately and not included below. Actual compensation varies based on location, experience, and qualifications.

• Total Cash Compensation Range: $150,000 - $210,000 per year

Additionally, the following benefits are provided by Red Ventures, subject to eligibility requirements.

• Health Insurance Coverage (medical, dental, and vision)
• Life Insurance
• Short and Long-Term Disability Insurance
• Flexible Spending Accounts
• Holiday Pay
• 401(k) with match
• Employee Assistance Program
• Paid Parental Bonding Benefit Program
• Flexible Paid Time Off (PTO): We believe time to rest and recharge is essential.  That’s why we offer a generous and flexible PTO policy.  Full-time employees accrue 20 days of PTO for a full calendar year annually, with an increase to 25 days after five years of service.

Who We Are:

Red Ventures is a global portfolio of high-growth companies — spanning several U.S. businesses, a joint venture in the health services industry, and strategic investments in Europe. Their businesses include The Points Guy, Lonely Planet, Bankrate, the Allconnect Platform, RV Home Client Growth, RV Growth & Transformation, Sage Home Loans Corporation, and more. Across the portfolio, Red Ventures businesses deliver seamless digital experiences for consumers, help Fortune 100 clients solve large-scale digital growth challenges, and create world-class experiences and opportunities for employees. Learn more at redventures.com and follow @RedVentures on LinkedIn and Instagram.

At Red Ventures, we believe diverse, inclusive teams are better. To help you better understand our core values and beliefs, we encourage you to watch this brief YouTube video: Our Belief Statements. This will give you insight into the principles that guide our work and our commitment to fostering an inclusive environment.

Red Ventures is an equal opportunity employer that does not discriminate against any employee or applicant because of race, creed, color, religion, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or any other basis protected by law. Employment at Red Ventures is based solely on a person's merit and qualifications. 

We are committed to providing equal employment opportunities to qualified individuals with disabilities. This includes providing reasonable accommodation where appropriate. Should you require a reasonable accommodation to apply or participate in the job application or interview process, please contact accommodation@redventures.com. 

If you are based in California, we encourage you to read this important information for California residents linked here.

At Red Ventures, we believe in real human connection. That’s why we do not hire someone through text, social media, or email only. As part of the hiring process, you should expect live conversations with RV teammates before any offer is made. Also, keep an eye on the sender: we only use official @redventures.com email addresses at the portfolio level or business specific email addresses (e.g., @thepointsguy.com), not ones like “redventurescareer.com.” We will never ask candidates to send money, buy equipment, or share financial account info during your journey with us. You can always find our open roles on redventures.com— if you receive a message that seems suspicious, please use redventures.com to verify the opportunity.

For more, the U.S. Federal Trade Commission has published helpful articles to help individuals learn more about protecting themselves from recruiter scams. If you think you’ve been targeted, feel free to report it to your local authorities. Stay safe out there!

#LI-LM2 #LI-HYBRID

WHAT WE DO

Our Security and Compliance consultants work with clients at all levels of the organization, from the C-suite to the shop floor, helping them to deliver on their most strategic initiatives. We’re known for making realistic, data-driven decisions that deliver value in tangible ways to our clients. Our clients ask for us on projects that require a superior combination of technical and business capabilities, people and management skills, and a collaborative mindset. We excel in understanding complex programs and strategic initiatives and breaking them into actionable pieces.

We are actively looking for professionals in the following areas:

• Compliance
• Information Security
• Risk Management
• Data Privacy

The ideal candidate’s experience may include but is not limited to the following:

• Management or participation in Cybersecurity, Information Security, Risk, Compliance and/or Data Privacy Programs or Projects
  • Sample projects/programs could include but are not limited to:
    • Compliance framework mapping and implementation,
    • Regulatory mapping and implementation
    • Audit, risk or regulatory remediation management,
    • Readiness for new laws and regulations,
    • Risk, Compliance or Information Security risk reporting and monitoring
    • Creation of roadmaps to mature or advance Risk, Compliance or Information Security Strategies/Programs/Controls
    • Design and enablement of cyber controls functions and processes
    • Change management related to regulatory adoption or compliance changes
    • Audit or certification readiness
  • Familiarity or direct experience with GRC/Cybersecurity solutions, tools and technologies
  • Control design or maturation for high-demand technical areas such as ERP, Identity and Access Management, Business Continuity and Resiliency, Cloud
  • Knowledge of and/or application of industry specific regulations, laws, and standards such as the EU-GDPR, CCPA/CPRA, HIPAA, PCI
  • Knowledge of and/or application of compliance and security frameworks and standards such as COSO, NIST, ISO
  • Management of regulatory, internal or external audits, or experience as an auditor
  • Projects or roles requiring coordination across lines of defense working with technical, business, compliance, risk and audit teams to deliver solutions
  • Work or projects with military or federal government agencies in Risk, Compliance or Information Security/Cyber Security sectors
  • Certifications: CIPP, CRCM, CRM, ARM, CISSP, CISM

QUALIFICATIONS

Required-

• Alignment to our core values: Excellence, Participation, Integrity, and Collaboration
• Hungry, Humble, Smart
• Demonstrated business and technology acumen
• Strong written and verbal communication skills
• Understanding and experience solving real business problems
• Proven track record of delivering results
• Experience working with and/or leading a team
• Ability to work across industries, roles, functions & technologies
• Authorization for permanent employment in the United States (this position is not eligible for immigration sponsorship)

Preferred-

• Bachelor’s degree
• 8+ years professional experience
• Experience across our service offerings