Own continuous compliance end-to-end — SOC 2, ISO 27001, and customer security reviews.
Manage and evolve the compliance roadmap, prioritizing initiatives against business and customer needs.
Lead quarterly access reviews across all systems in collaboration with IT and Engineering.
Run vendor risk reviews and DPIAs for new tools — especially AI tooling.
Serve as the technical voice on customer security questionnaires and DPAs.
Define and report compliance and risk KPIs to leadership.
Partner with the Security Architect to identify and close gaps between written policy and actual control implementation.

4+ years in GRC, security compliance, or audit readiness at a SaaS company.
Has owned a SOC 2 program end-to-end (must-have).
Ideally ISO 27001 too, from gap analysis through audit and maintenance.
Deep experience running Vanta (or Drata/Secureframe) as a continuous compliance backbone.
Technically hands-on: comfortable scripting against AWS APIs to automate evidence collection.
A strong writer and communicator who can turn around a 200-row security questionnaire quickly and accurately.

Work with colleagues that lift you up, challenge you, celebrate you and help you grow.
Make an impact and meaningfully shape an early-stage company.
Experience a truly flat hierarchy and communicate directly with founding team members.
Learn from experienced mentors and achieve tremendous personal and professional growth.
Receive a top-of-market equity and cash compensation package.
Get access to a self-development budget you can use to e.g. attend conferences, buy books or take classes.
Use the equipment of your choice including meaningful home office set-up.

GRC Engineer – Platform Team

Key skills