GRC & Privacy Lead

📋 Description

• Triage vendor intake requests daily, assess inherent risk based on data sensitivity and system
• Analyze vendor assurance documentation — SOC 2 reports, ISO certifications, PCI AOCs, and
• Gather and organize evidence for our active SOC 2 Type II engagement, coordinate with control
• Process DSAR requests across multiple corporate entities, applying correct retention exemptions and
• Run privacy impact assessments for new product features and vendor onboarding, working directly
• Maintain the policy library, track review and acknowledgment cycles, and own remediation tracking

🎯 Requirements

• Hands-on SOC 2 Type II audit experience — you have personally gathered evidence, coordinated with
• Demonstrated experience conducting third-party vendor risk assessments, including reading and
• Working knowledge of GDPR, CCPA/CPRA, BIPA, and CUBI, and the ability to translate those
• Experience building compliance or privacy processes from scratch, not just inheriting and
• Comfort operating independently, triaging ambiguous situations, and making defensible decisions

🎁 Benefits

• Competitive salary & equity
• Unlimited PTO
• Full Health, Vision, & Dental coverage
• 401k match
• Hardware setup: new MacBook Pro, big display, & accessories