GRC Manager

📋 Description

• Report to Head of InfoSec & Compliance; mature GRC programs with cross-functional teams.
• Manage the GRC control evidence library; investigate flags and collect evidence.
• Manage vendor risk program; intake, security/risk assessments, reviews, monitoring.
• Review security artifacts: SOC 2 Type II, pen tests, CAIQ, SIG, ISO, audits.
• Assist with implementing security/risk frameworks; add GDPR/ISO/SOC 2 controls.
• Assist with security questionnaires and client audits; manage knowledge base.

🎯 Requirements

• 4+ years in GRC/InfoSec with experience scaling programs.
• Hands-on GRC program at scale in high-growth SaaS/tech.
• Experience with GRC platforms: compliance, risk registers, policy lifecycle, evidence collection.
• Deep expertise in SOC 2 Type II and ISO 27001; HIPAA knowledge preferred.
• Experience conducting product/enterprise risk assessments with quant methods.
• AI-forward; automate processes; certifications: CISM/CRISC/CISA/CCSP preferred.

🎁 Benefits

• Compensation and equity: salary and stock options.
• Health plans: 100% coverage for medical, dental, vision.
• Time off: Unlimited PTO and 11 holidays.
• Health: Unlimited sick leave.
• Parental leave: Paid leave for new parents.
• Remote-friendly: $1,000 home office stipend.