GRC Lead

Accountabilities

• Own customer security reviews, including security questionnaires, due diligence requests, and customer security calls, using AI-assisted workflows to accelerate research and drafting while applying rigorous judgment to ensure accuracy.

• Analyze unfamiliar or complex security questions and collaborate with the appropriate technical experts to provide precise, credible, and well-supported responses.

• Help teams evaluate customer security requirements, vendor risks, compliance gaps, and other risk-related concerns, ensuring decisions are clearly documented, appropriately owned, and followed through to completion.

• Maintain accurate and approved security responses and supporting evidence, using AI and automation to identify inconsistencies, outdated information, and differences across products, configurations, and planned capabilities.

• Own SOC 2 and ISO 27001 compliance programs, including audit preparation, control management, external partner coordination, gap assessment, remediation, and ongoing effectiveness between audits.

• Establish priorities for external compliance and audit partners, evaluate the quality of their work, and ensure identified gaps are addressed efficiently.

• Evaluate potential new compliance programs based on customer requirements, target markets, implementation effort, and ongoing maintenance costs.

• Track security and compliance commitments with clear owners, deadlines, and follow-through mechanisms to ensure remediation efforts are completed.

• Build automation, self-service resources, and scalable processes that reduce repetitive GRC work and increase the efficiency of a lean team.

• Identify recurring customer security questions and translate those patterns into improvements to documentation, controls, processes, and product capabilities.

• Partner cross-functionally with Engineering, Security, IT, Legal, and customer-facing teams to continuously strengthen security and compliance practices.

Requirements:

• Proven experience personally owning a compliance program or leading a significant audit cycle, combined with hands-on experience managing customer security reviews.

• Strong understanding of governance, risk, and compliance principles, with practical experience across security assurance, audits, controls, and remediation.

• Demonstrated ability to make sound risk-based decisions, articulate tradeoffs, and determine when risks should be accepted, mitigated, or escalated.

• Strong technical curiosity and the ability to engage credibly with engineers on topics such as data flows, access controls, cloud infrastructure, and data storage.

• Experience with SOC 2 and ISO 27001 programs, including control management, evidence collection, audit preparation, and remediation activities.

• Strong AI fluency and attention to detail, with the ability to build or leverage AI-assisted workflows while identifying unsupported, inaccurate, or misleading outputs.

• Excellent written and verbal communication skills, particularly the ability to explain security posture and compliance requirements clearly to customers and internal stakeholders.

• Strong customer-facing skills and the ability to communicate transparently when requirements are complex or specific capabilities are not yet available.

• High ownership, urgency, and accountability, with the ability to make progress despite incomplete information and consistently close open loops.

• A builder-oriented mindset, with demonstrated experience simplifying processes, automating repetitive work, developing self-service resources, or creating more efficient ways to meet security and compliance requirements.

• Ability to operate autonomously in a fast-paced environment and collaborate effectively across technical, legal, security, IT, and customer-facing functions.

• Experience in a senior individual contributor or hands-on management capacity is welcome; demonstrated impact and growth potential are valued more highly than a specific number of years of experience.

Benefits:

• Competitive annual salary of $160,000–$230,000 USD, location-independent in accordance with the remote-first policy.

• Meaningful equity compensation.

• Fully remote opportunity across North America.

• High degree of autonomy and ownership in building a GRC function from the ground up.

• Opportunity to directly shape customer security assurance, compliance strategy, risk management, and audit programs.

• Exposure to AI-powered workflows and automation designed to increase the impact and efficiency of a lean GRC function.

• Close collaboration with Engineering, Security, IT, Legal, and customer-facing teams.

• Opportunity to grow the GRC function and potentially develop into a management role as the organization scales.

• Fast-paced environment focused on practical decision-making, continuous improvement, and measurable impact.