Risk and Compliance Lead

Skills

About the Role

You will lead certification and audit programs, maintain the security risk register, and monitor compliance controls. You will manage auditors, create audit documentation, run readiness assessments, track remediation, support privacy compliance, and report compliance posture to security leadership.

Requirements

• 8+ years in security compliance, IT audit, or GRC roles
• Direct ownership of a SOC 2 or ISO 27001 certification cycle
• Knowledge of SOC 2, ISO 27001, and NIST CSF
• Experience maintaining ISMS, SSP, or equivalent audit documentation
• Experience owning a formal risk register
• Experience with GRC automation platforms and continuous control monitoring
• Experience managing external audits end to end
• Ability to review technical control evidence
• Knowledge of GDPR and privacy fundamentals

Responsibilities

• Own certification roadmaps, scoping, gap assessments, remediation, and audit execution
• Manage external auditor relationships and the audit calendar
• Maintain the security risk register, treatment plans, and residual-risk reporting
• Build continuous compliance monitoring
• Maintain audit artifacts including ISMS documentation, Statements of Applicability, and risk assessments
• Run audits and readiness assessments and track findings to closure
• Support GDPR and privacy compliance
• Define automated and manual evidence collection with the GRC Engineer
• Report compliance posture and audit findings to security leadership

Benefits

• Equity
• 401(k) program with 4% match
• Health, dental, vision, and life insurance
• Short-term and long-term disability insurance
• Paid parental, medical, and caregiver leave
• Flexible time off and holidays
• Commuter benefits
• Monthly wellness stipend
• In-office setup reimbursement
• Quarterly team gatherings
• In-office amenities