Lead strategic GRC initiatives end-to-end, including achieving and maintaining industry certifications (e.g., SOC 2, HITRUST, ISO 27001).
Develop, implement, and oversee security and compliance policies; ensure they are embedded into business operations.
Partner with Product, Engineering, and Privacy to integrate security and compliance by design into new features, infrastructure, and business processes.
Anticipate, monitor, and interpret regulatory changes and industry trends; proactively evolve the GRC strategy.
Lead risk assessments and mitigation strategies, ensuring ownership and accountability across teams.
Oversee audit readiness and execution, including internal, customer, and third-party assessments.
Mentor peers and drive a culture of compliance and risk awareness across the company.
Requirements
7+ years in GRC, IT compliance, security, or risk management, with demonstrable leadership of cross-functional projects.
Deep expertise in frameworks such as SOC 2, HIPAA, HITRUST, NIST 800-171, ISO27001, ISO27799, CMMC, and FedRAMP.
Familiarity with IT and cloud environments (AWS, GCP), security controls, and compliance automation tooling.
Ability to influence, communicate, and drive alignment across technical and non-technical stakeholders.
Strong background in leading risk assessments, compliance audits, and executive-level reporting.
Preferred Certifications: CGRC, CISA, CRISC, CISSP, or equivalent.
Benefits
Competitive salary and equity packages
Health, dental, vision insurance, and mental health resources
An Oura Ring of your own plus employee discounts for friends & family
20 days of paid time off plus 13 paid holidays plus 8 days of flexible wellness time off
Paid sick leave and parental leave
Applicant Tracking System Keywords
Tip: use these terms in your resume and cover letter to boost ATS matches.