GRC Program Manager, Assurance Engineering & Control Systems

Responsibilities

• Lead external, internal, customer, and certification audit work from scoping through evidence review, fieldwork, remediation, and closeout.
• Build a common control framework linking risk, control intent, implementation, owner, system, environment, evidence, and applicable frameworks.
• Validate actual scope and ownership rather than assuming prior controls, product boundaries, or evidence remain accurate.
• Use Codex to build and test evidence checks, control mappings, request triage, owner workflows, monitoring, and remediation reporting.
• Partner with engineers on cloud architecture, identity, logging, data flows, software changes, vulnerabilities, and control effectiveness.
• Design maintainable, permission-aware tools that preserve source provenance, human review, and evidence integrity.
• Reduce repeated requests and operational burden for control owners through measurable workflow improvements.
• Define roadmaps, decision rights, milestones, success metrics, and cross-functional escalations.

Requirements

• Direct ownership of meaningful audit, security, customer-assurance, or regulatory outcomes.
• Practical knowledge of control design, evidence, testing, operating effectiveness, and remediation.
• Technical fluency across cloud systems, identity, logging, APIs, data flows, and system boundaries.
• Ability to use Codex or comparable AI-assisted development tools to build, run, inspect, and test a working solution.
• Experience using code, SQL, APIs, structured data, automation, or data workflows to solve operational problems.
• Ability to design reusable cross-framework controls without removing framework-specific testing and evidence requirements.
• First-principles curiosity, creative problem solving, intellectual humility, and adaptability when facts change.
• Product and program judgment, including defining users, scope, milestones, ownership, adoption, and measurable outcomes.
• Clear, constructive partnership with Security, Engineering, Infrastructure, Product, Privacy, Legal, and audit teams.

Nice-to-haves

• Familiarity with SOC 2, ISO 27001/27017, PCI DSS, NIST, or FedRAMP.
• A specific degree or certification is not required.

Compensation

• Annual salary: $216,000–$252,000.