# Governance, Risk, and Compliance Manager - Privacy

**Company:** [Decagon](https://hotfix.jobs/companies/decagon)
**Location:** San Francisco, CA
**Role:** Security Engineering
**Salary:** $190k – $275k/yr
**Experience:** 5+ years
**Skills:** Iso 27701, Iso 27018, HIPAA, GDPR, Ccpa/Cpra, SOC 2, ISO 27001, Ai Governance, Data Privacy, Dpias, Vanta, Drata, Secureframe, GCP
**Posted:** 2026-08-21

> Own and operate Decagon’s privacy and GRC programs, including regulatory compliance, data governance, customer security engagements, audits, and cross-functional privacy initiatives. The role requires 5+ years of GRC experience, strong communication and project management skills, and familiarity with enterprise security controls.

## Job Description

## Responsibilities
- Improve and maintain the privacy program against ISO 27701, ISO 27018, HIPAA, GDPR, CCPA/CPRA, and other U.S. state privacy laws.
- Own privacy program operations, including data inventory, DSAR intake and fulfillment, DPAs, cross-border transfer mechanisms, data retention schedules, subprocessor onboarding and public subprocessor listings, breach notification readiness, and privacy training.
- Partner with Legal on data residency, subprocessor flow-downs, retention by data class, DPIAs, and transfer impact assessments.
- Drive day-to-day privacy and compliance decisions.

## Requirements
- 5+ years of GRC experience in high-growth SaaS or technology companies, with direct responsibility for privacy compliance programs.
- Experience contributing to SOC 2, ISO 27001, or similar enterprise compliance certifications.
- Experience with CCPA, GDPR, and emerging AI governance frameworks.
- Strong project management skills and ability to coordinate cross-functional teams under tight deadlines.
- Excellent written and verbal communication skills.
- Working knowledge of technical security controls and ability to collaborate with engineering teams.

## Nice-to-haves
- Experience with AI/ML compliance frameworks and risks in conversational AI systems.
- Healthcare or financial services experience, including HIPAA or PCI requirements.
- Experience building GRC programs as companies scale from startup to enterprise.
- Experience with Vanta, Drata, or SecureFrame.
- Understanding of Google Cloud security and compliance features.

## Compensation & Benefits
- $190K–$275K plus equity.
- Medical, dental, and vision benefits for employees and families.
- Life insurance and disability benefits.
- Retirement plan.
- Parental leave.
- Fertility and family-building benefits.
- Monthly wellness and lifestyle stipend.
- Daily office lunches and snacks.
- Flexible vacation policy.

## Similar jobs

- [Safeguards Policy Analyst, Cyber Harms](https://hotfix.jobs/jobs/b7a7ba79-b5ba-42b9-930f-19f379ea9abd) - Anthropic - San Francisco, CA - $190k – $285k/yr
- [Governance, Risk, and Compliance Manager](https://hotfix.jobs/jobs/5e407075-824a-4639-96f7-821772a6f497) - Decagon - San Francisco, CA - $190k – $275k/yr
- [Manager, Security Incident Response](https://hotfix.jobs/jobs/fe4d4111-7237-4acc-be44-fce689acc71f) - 1Password - Remote - $192k – $278k/yr
- [QMS Manager](https://hotfix.jobs/jobs/4c317f13-ae5c-4532-bffc-617f1e288c04) - Huntress - Remote - $185k – $200k/yr
- [Platform Security Engineer](https://hotfix.jobs/jobs/353f9275-bc29-458a-b515-4512339e0155) - Glean - Remote - $185k – $260k/yr

**Apply:** https://hotfix.jobs/jobs/a5153f89-2b1c-40d2-b939-13b82952a049
**Canonical:** https://hotfix.jobs/jobs/a5153f89-2b1c-40d2-b939-13b82952a049