Information Security and GRC Manager

📋 Description

• Run our SOC 2 program end to end. This covers control ownership, evidence collection, auditor
• Own customer security reviews. You'll complete questionnaires, maintain our trust center and
• Give Legal technical input on the security commitments in customer contracts (MSAs, DPAs, BAAs, AI
• Maintain the risk register, security policies, and vendor security review process. When you see
• Turn audit findings, control requirements, and security issues into concrete engineering work, and
• Operate and scale core internal security programs: access reviews, security awareness training

🎯 Requirements

• 6+ years of experience in information security, GRC, or security compliance at a SaaS or technology
• Hands-on experience running SOC 2 Type II audits, as the person who actually did the work rather
• Experience handling enterprise customer security reviews and questionnaires alongside Sales
• Enough working knowledge of cloud security, identity and access management, endpoint security, and
• Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe).
• Sound judgment about risk: you can tell what needs immediate attention from what can wait, and you

🎁 Benefits

• Healthcare Coverage – Comprehensive health, dental, and vision plans, including two $0/month
• Equity – Ownership in what we're building
• 401(k) Plan – through Vestwell
• Flex Benefit – $500/year for home office equipment, productivity tools, learning & development
• Commuter Benefits – $100/month for SF based employees
• PTO – Flexible paid time off and company holidays