10+ years of experience in compliance assurance and technology risk management.
Bachelor's degree in information systems, computer science, or a related field.
Hands-on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle.
Direct experience managing an automated GRC/compliance platform like Vanta.
Proven ability to manage multiple compliance initiatives and navigate relationships independently.
Strong judgment to minimize stakeholder interruptions.
Excellent writing skills for policies and audit narratives.
Responsibilities
Lead compliance assurance programs for SOC 2 Type II and ISO 27001:2022, ensuring low stakeholder impact.
Manage relationships with auditors and compliance partners, keeping management updated on findings.
Own and configure the automated GRC platform as the system of record.
Design and implement new compliance processes as needed.
Critically evaluate evidence rather than accepting it at face value.
Set standards for security questionnaire responses, reducing internal stakeholder workload.
Contribute to the strategic governance and compliance vision aligned with business priorities.
Benefits
Opportunity to design compliance processes from the ground up.
Engagement in high-stakes compliance programs like FedRAMP.
Collaborative work environment with engineering and internal stakeholders.
Mentorship opportunities for teammates.
Exposure to a variety of GRC responsibilities, enhancing professional growth.
Full Job Description
About the Role
We're looking for a Staff GRC Specialist to join our GRC team and help run a compliance program that's audit-ready by design, not by scramble. In this role, you'll partner with the Head of GRC to own execution of our existing SOC 2 Type II and ISO 27001 and any future programs end to end, operate Vanta as our system of record, and lead our day-to-day work with internal stakeholders, auditors and compliance partners. You'll work closely with engineering to cut the interrupt load of security questions and evidence requests, and you'll help teammates do the same. You'll also have the opportunity to design the compliance processes that don't exist yet and to help drive our FedRAMP effort, one of the most demanding compliance programs a company can pursue. Our interview process reflects the role itself: a control design and an audit management process walkthrough where you'll talk through a real experience you've had.
Responsibilities
Lead core compliance assurance programs, including SOC 2 Type II and ISO 27001:2022 readiness end to end, building continuously toward a well executed and low stakeholder impact audit program.
Manage auditor and partner relationships directly, keeping management informed on scope and findings.
Own the automated GRC platform as the system of record - configuring tests, keeping evidence current, and closing gaps before they become findings.
Design and build the compliance processes that don't exist yet
Evaluate evidence critically rather than take it at face value
Set the standard for security questionnaire and customer compliance responses, taking questions and evidence requests off internal stakeholder's plate and coaching teammates to do the same.
Contribute to defining the strategic governance and compliance vision and plans aligned with general Blitzy business priorities
Contribute, support and eventually drive some of the wide range of GRC responsibilities, including third party and vendor risk management, customer trust and sales enablement and BC/DR governance.
Qualifications
Required
10+ years of experience in compliance assurance, controls and technology risk management.
Bachelor's in information system, computer science or a related field.
Personal, hands-on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle - not just adjacent to one.
Direct experience running an automated GRC/compliance platform (Vanta or equivalent) as a primary owner.
A track record of managing multiple compliance initiatives at once as well as navigating auditor, stakeholder and vendor relationships independently, with sound judgment on when to escalate.
The seniority and judgment to reduce stakeholder interrupt load, not add to it.
Clear writing - policies, audit narratives, and questionnaire responses that hold up under scrutiny.
Experience mentoring teammates or setting working standards for others.
Nice to Have
Vendor risk management experience
Customer trust experience (security questionnaires and sales enablement)
Prior work at an early stage/high growth tech company
FedRAMP exposure at any level.
A track record of building a compliance process from scratch, not just running an existing playbook.
