Senior GRC Specialist

What you'll do

• Own day-to-day GRC operations including user access reviews and certifications, security awareness and phishing/deepfake simulation facilitation, JML tracking, and triage and enforcement of policy and control exceptions.
• Run the risk management program: perform annual and ad-hoc risk assessments, maintain the risk register, partner with risk owners on remediation, and track issues through to closure.
• Manage third-party risk: run vendor and subprocessor risk assessments, conduct ongoing monitoring, and track remediation across critical vendors.
• Design and execute targeted internal audits to test control effectiveness, and facilitate or support external audit cycles by coordinating evidence, control owners, and remediation.
• Own continuous control monitoring and evidence automation: administer our GRC platform, keep automated control tests and evidence healthy, and maintain audit readiness year-round.
• Build and foster relationships with cross-functional partners across engineering, IT, operations, legal, and sales.
• Partner with control owners to educate them on their control responsibilities, prepare them for audits, and help operationalize controls.
• Keep the policy library current by reviewing and updating security policies, standards, and procedures.
• Turn program data into action: translate access review, awareness, and risk findings into insights and metrics that drive interventions.

How the role will grow

• End-to-end audit leadership: move from supporting to owning audits including scoping and coordination.
• Program and control maturity: lead control improvement and automation initiatives.
• Leadership and influence: mentor team members, represent GRC in projects, and shape program direction.

What we're looking for

• 5-7 years of experience in GRC, IT audit, information security, or a closely related field.
• Working knowledge of major security and privacy frameworks such as SOC 2, ISO 27001/27701/42001, NIST CSF, HIPAA, GDPR, or CCPA.
• Experience with GRC platforms (Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC).
• Experience running user access reviews and understanding of identity and access management concepts (RBAC, least privilege, segregation of duties, JML processes).
• Hands-on experience administering a security awareness or phishing simulation platform (Adaptive Security, KnowBe4, Hoxhunt, Proofpoint, or similar).
• Comfort with cloud environments (AWS, GCP, or Azure) and how SaaS products are built and operated.
• Strong written communication skills to translate control requirements and security concepts for technical and non-technical audiences.
• Detail-oriented and organized with ability to manage multiple audits, campaigns, and deadlines.
• Collaborative mindset focused on partnership across teams.