Senior Governance, Risk, and Compliance (GRC) Specialist

We are seeking a Senior GRC Specialist to maintain, enhance, and scale our control environment. This role is crucial in strengthening our security compliance posture, increasing customer trust, and enabling company growth.

As a senior member of the Information Security & Compliance team, you will own compliance initiatives end-to-end, lead audits, and act as a trusted partner to internal teams and external stakeholders.

Key responsibilities:

• Lead compliance programs and audit processes (SOC 2, PCI DSS, GDPR, HIPAA/HITECH) from planning to completion.
• Drive evidence collection, documentation, and audit readiness.
• Act as a primary point of contact for external auditors, customers, and prospects on security and compliance matters.
• Lead security discussions with enterprise customers.
• Oversee internal and external assessments.
• Evolve the Third-Party Risk Management program.
• Maintain, enhance, and scale security controls and compliance processes.
• Partner with engineering and product teams to implement compliance requirements.
• Track and drive remediation efforts.
• Produce and present audit and compliance reports.
• Promote security awareness and stay ahead of evolving regulatory trends.

Requirements:

• 6+ years of experience in Information Security, GRC, Audit, or Risk Management.
• Hands-on experience with SOC 2, PCI DSS, GDPR, HIPAA/HITECH.
• Proven experience in leading audits and compliance initiatives.
• Experience with cloud-based systems (preferably AWS).
• Strong project and stakeholder management skills.
• Analytical and problem-solving skills.
• Ability to translate complex security concepts into clear documentation.
• Strong communication skills.
• High level of curiosity, adaptability, and proactive ownership.
• Excellent written and spoken English.

Preferred qualifications:

• Experience with ISO/IEC 42001.
• Relevant certifications: CISA, CISM, CRISC, CISSP, ISO/IEC 27001 Lead Auditor, or ISO/IEC 42001 Lead Auditor.
• Experience with ISO/IEC 27001 implementation.