Program Manager – Level III (GRC & IT Controls)

About the role

We are looking for a senior‑level GRC professional to join our Digital Technology team. The Program Manager will lead the design, testing and remediation of technology controls across the enterprise, with a focus on IT General Controls, IT Application Controls and emerging AI risk frameworks.

Key responsibilities

• Design, document and recommend technology controls aligned to NIST AI Risk Management Framework, NIST SP 800‑53, ISO 27001 and SOX IT General Controls.
• Plan and execute control testing for design and operating effectiveness of IT General Controls (Logical Access, Change Management, IT Operations) and IT Application Controls.
• Develop repeatable, auditor‑defensible test plans and evaluate control evidence for completeness, accuracy and relevance.
• Support AI risk assessments for internal AI systems and third‑party AI tools, covering multiple risk domains.
• Analyze regulatory and internal policy changes, identify control gaps and propose remediation.
• Manage issue lifecycle: root‑cause analysis, remediation recommendations, tracking commitments and escalation.

Required profile

• Proven experience in IT risk, controls or IT audit, preferably with a Big 4 background.
• Strong knowledge of IT General Controls (Logical Access, Change Management, IT Operations).
• Ability to work independently in a fully remote environment (Costa Rica).
• Senior or manager‑level experience; flexibility to learn AI risk governance on the job.

Required skills

• NIST AI Risk Management Framework
• NIST SP 800‑53
• ISO 27001
• SOX IT General Controls
• IT General Controls – Logical Access, Change Management, IT Operations
• IT audit and control testing methodologies