The RoleAs VP of GRC, you will build and lead Zania's customer-facing GRC organization. You will be the senior GRC voice in front of our largest customers and partners, turning Zania's agents into audit-ready outcomes across SOC 2, ISO 27001, ISO 42001, NIST, HIPAA, PCI DSS, and third-party risk programs, delivered faster and with more coverage than any traditional team.
Our customers include Fortune 500 enterprises and Big 4 firms who are replacing weeks of manual compliance work with agents. You will own how those engagements are scoped, delivered, and expanded, and you will work with the founders, product, and AI engineering to make sure what we learn in the field makes our agents better.
What You'll Do- Build the GRC organization: Hire, coach, and scale a team of GRC leads, solutions architects, and compliance specialists.
- Own customer delivery: Lead GRC engagements end to end, from scoping and onboarding through gap assessments, controls testing, audit readiness, and third-party risk programs.
- Be the executive GRC advisor: Serve as a trusted advisor to CISOs, CROs, Chief Audit Executives, and Big 4 and advisory partners.
- Build agent-first playbooks: Design repeatable delivery methodologies across SOC 2, ISO 27001/42001, NIST CSF/800-53, HIPAA, PCI DSS, GDPR, DORA, and the EU AI Act.
- Shape the product: Partner with product and AI engineering to turn field insight into agent capabilities, evaluation criteria, and human-in-the-loop guardrails.
- Support strategic deals: Lead GRC discovery, solution design, and proof-of-value work with the sales team on our largest opportunities.
- Measure what matters: Define and report on time to audit readiness, assessment cycle time, vendor coverage, customer satisfaction, and expansion.
Representative Projects- Take a Fortune 500 customer from kickoff to SOC 2 and ISO 27001 audit readiness in weeks using Zania's agents, and turn it into a repeatable playbook.
- Roll out Zania Autonomous TPRM across a customer's full vendor base, moving coverage from a fraction of vendors to 100% of in-scope vendors.
- Build an ISO 42001 and EU AI Act readiness offering with a Big 4 partner for enterprises adopting AI.
What You Have- Deep GRC expertise (required): You have run audits, assessments, and remediation programs yourself and can speak credibly with CISOs, auditors, and risk leaders about any major framework.
- Customer-facing leadership: You have led client-facing GRC or audit teams and know how to deliver high-stakes engagements on time.
- Executive presence: You build trust quickly with security, risk, and audit leaders at large enterprises and advisory firms.
- Builder mentality: You have built a team, practice, or program from early stages and are comfortable owning it end to end.
- AI curiosity: You believe agents will change how GRC work gets done and want to help define how.
Minimum Qualifications- Bachelor's degree in Information Security, Accounting, Business, or a related field, or equivalent practical experience.
- 12+ years of experience in GRC, IT audit, or security compliance.
- 5+ years leading customer-facing GRC, audit, or advisory teams.
- Hands-on expertise with SOC 2, ISO 27001, NIST, and third-party risk management.
- Strong structured written and verbal communication skills.
Nice to Have- Experience at a Big 4 or advisory firm, or at a GRC platform company.
- Certifications such as CISA, CISSP, CRISC, CISM, or ISO 27001 Lead Auditor.
- Familiarity with AI governance frameworks (ISO 42001, NIST AI RMF, EU AI Act).
- Experience as an early leader at a high-growth startup.
Compensation & Benefits- Competitive salary + significant equity
- Flexible PTO
- Medical, dental, and vision insurance
- Meals and snacks in the office
- Relocation and immigration support
