GRC Manager

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of and enhance Mattermost's compliance initiatives within federal and commercial sectors.

• Direct the readiness, certification, and surveillance processes across both compliance programs.

• Manage the risk management program comprehensively, from identification and assessment to treatment and acceptance.

• Oversee the third-party and vendor risk management program, including conducting security assessments and addressing supply chain risks.

• Implement GRC engineering and automation to transition from manual evidence collection to ongoing controls monitoring.

• Develop AI-driven workflows to streamline and enhance recurring compliance tasks.

• Maintain the control library, system security plans, POA&Ms, and associated policies.

• Coordinate external audits from the initial scoping phase to remediation actions.

• Manage customer security questionnaires, trust center content, and reusable compliance artifacts to expedite deal processes.

• Expand and lead the GRC team as the program evolves.

• Deliver a CMMC Level 2 gap assessment and a readiness roadmap within the first 90 days.

• Ensure timely completion of SOC 2 Type II and ISO 27001 audit cycles.

• Keep customer security questionnaires and trust center content updated to facilitate deal cycles.

• Establish a scalable, program-driven GRC function.

⛳️ Requirements

• Bachelor's degree in computer science, information security, or a related field — or extensive professional experience in GRC and compliance.

• Demonstrated senior-level expertise in governance, risk, and compliance, security compliance, or IT audit, with direct responsibility for a certification or authorization program.

• Familiarity with U.S. Federal standards, including CMMC and NIST series (800-171 / 800-53).

• Knowledge of ISO 27001 and SOC 2 Type II.

• Experience in operating a formal risk management program.

• Proven track record in managing a third-party and vendor risk management program.

• Experience in customer-facing security assurance, including security questionnaires and trust center content management.

• Working knowledge of security controls for cloud environments (AWS, GCP, and/or Azure).

• Exceptional written and verbal communication skills.

• Candidates must fulfill federal eligibility criteria to be considered.

• Applicants must meet eligibility requirements for access to export-controlled information under U.S. export control laws, including EAR and ITAR.

• This role may require obtaining and maintaining a U.S. government security clearance.

• Preferred: Professional GRC certifications such as CISA, CRISC, CISM, CISSP, or CIPP.

• Preferred: Experience with AI platforms like Claude, OpenAI, or Gemini.

• Preferred: Familiarity with compliance automation tools such as Vanta or Drata, and continuous controls monitoring.

• Preferred: Direct experience in applying AI or LLM-based workflows to GRC tasks.

• Preferred: Proficiency in no-code automation or scripting languages.

• Preferred: Previous success in critical infrastructure sectors such as defense, cybersecurity, communications, or manufacturing.

🏝️ Benefits

• Remote-first work environment.

• Medical coverage.

• Dental coverage.

• Vision coverage.

• Unlimited PTO.

• Company holidays.

• Work from home stipend.

• Annual budget for learning and development, including conferences, certifications, and courses.

• Paid parental leave for all parents.

• 401(k) plan.

• Mission-driven work.

• Open-source developer community.

• AI-forward environment.

• Globally distributed, high-trust team designed for autonomy and ownership.