GRC Manager

This is a fully remote position, open to applicants in United States.

📋 Description

• Take full ownership of Drata, encompassing administration, integrations, monitoring test health, and collecting manual evidence.

• Develop and maintain the SafeBase knowledge repository, enabling sales to independently manage customer security questionnaires and escalations.

• Oversee personnel compliance, which includes policy acknowledgments, device compliance, and regular security and compliance training sessions.

• Conduct user access reviews, penetration tests, business continuity/disaster recovery (BCDR) exercises, incident response tabletop scenarios, annual policy reviews and updates, and risk assessments.

• Collaborate closely with Engineering to address product-related compliance inquiries concerning data management and customer obligations.

• Ensure audit readiness for various standards including SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.

• Interpret new AI regulations and integrate them into operational controls.

• Work in partnership with HR, Legal, Customer Support, and Finance to embed compliance into current workflows.

• Report directly to the Head of IT & Security and manage the program with minimal daily oversight.

⛳️ Requirements

• Multiple years of experience in Governance, Risk, and Compliance (GRC) or compliance, with a hands-on approach—having built and managed programs rather than merely overseeing them.

• Experience owning at least one SOC 2 audit cycle from start to finish, with evidence gathered through fieldwork.

• Proficient at an administrative level in a compliance automation platform, with a strong preference for Drata.

• Sufficiently technical to engage in meaningful discussions with engineers regarding architecture and data flows.

• Demonstrated ability to influence cross-functional teams effectively.

• Adaptable and comfortable with changing requirements where there may not be established precedents.

• Preferred: Experience with PCI DSS in a startup environment.

• Preferred: Familiarity with HIPAA as a Business Associate.

• Preferred: Knowledge of the EU AI Act or other emerging AI regulations.

• Preferred: Certifications such as CISA, CISSP, or CIPP.

• Preferred: Experience as the first compliance hire.

• Preferred: Skills in scripting for evidence collection.

🏝️ Benefits

• Equity.

• Remote work options available (US).