GRC Principal - Data Privacy and Security

Responsibilities

Data Security GRC

• Lead the annual SOC 1 and SOC 2 Type II audit lifecycle, including control monitoring, readiness, auditor coordination, evidence collection, and reporting.
• Drive control-owner accountability and develop continuous, evidence-driven controls.
• Own and evolve the ISMS policy suite and control framework across SOC 1, SOC 2 Type II, and potential ISO compliance programs.
• Mature the vendor and third-party risk management program, including frameworks, prioritization, stakeholder management, and measurement.
• Lead customer assurance efforts for enterprise security reviews and cyber-insurance self-assessments.
• Scale security and privacy documentation and assurance mechanisms.

Data Privacy GRC

• Build and evolve data governance across collection, storage, access, retention, and deletion.
• Own recommendations and decisions for dynamic data governance challenges.
• Develop the privacy compliance program across GDPR and CCPA, including DSAR operations, data mapping, retention, governance, and classification.
• Partner with Legal on DPAs, subprocessor obligations, and privacy-by-design in products.
• Help shape enterprise AI data governance policies, standards, and controls across internally built and procured AI/ML systems.
• Track regulatory and framework developments, including NIST AI RMF, ISO 42001, and the EU AI Act, and translate them into organizational requirements.

Cross-Functional Leadership

• Translate technical and regulatory risk into actionable business terms for executives and leaders.
• Represent the organization’s risk posture to executives, auditors, enterprise customers, and other external stakeholders.
• Serve as a subject-matter authority and trusted advisor on security and privacy governance and compliance.
• Mentor cross-functional partners and team members and establish organizational standards for the discipline.
• Own project management, frameworks, measurement, prioritization, reporting, and risk-impact communication.

Requirements

• 10+ years of experience in GRC, information security, and privacy compliance.
• Track record of building, scaling, and operating rigorous programs, ideally in fintech, startups, payments, or SaaS.
• Proven experience using AI to automate GRC work and improve measurable program outcomes.
• Deep hands-on expertise in SOC 2, ISO 27001, PCI DSS, GDPR, CCPA, DSAR operations, and data governance.
• Working fluency in AI/ML governance and emerging regulatory requirements.
• Experience owning SOC audit lifecycles and enterprise, vendor, and third-party risk programs.
• Exceptional cross-functional influence with executives and technical teams without direct authority.
• High integrity, discretion, ethics, and confidentiality when handling sensitive data and risk decisions.
• Strong project management, prioritization, measurement, and executive reporting skills.

Nice-to-Haves

• CISSP, CISA, CISM, CRISC, CIPP, CIPM, CIPT, and/or AIGP certification.

Compensation and Benefits

• Salary: $143,000–$232,000 USD annually.
• Unlimited paid time off.
• Work from anywhere in Canada and the United States.
• Health and dental benefits.
• Up to $1,500 USD / $2,025 CAD toward home IT setup.
• Up to 2% matching RRSP / 401(k).
• Learning and development opportunities.
• Up to $50 USD / $67.50 CAD toward internet or cell phone service.