← All roles

Security GRC Lead

Mercor· Security
Apply on company site
San Francisco$350k - $425kFull-timePosted 1mo ago

About the role

Lead the organization’s GRC program as the first GRC hire, owning continuous monitoring, ISO 27001 buildout, and customer/third-party audits with a data-rich, AI-native approach.

Responsibilities

  • The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act conformity - sequencing decided by you)
  • Build a customer-audit machine that responds to customers
  • Develop the third-party risk program with formal intake, recurring review cadence, and evidence requirements integrated into procurement
  • Own policy lifecycle end-to-end (versioning, attestation, exception handling, review cycle)
  • Develop controls-as-code where appropriate (integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection)
  • Define data-handling procedures (customer-data deletion gap, DSAR workflow, KMS scheduled destruction, offboarding handlers)
  • Shape the internal trust narrative (customer trust pages, security one-pagers, executive-ready disclosure templates for incidents)

Qualifications

  • 7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under enterprise audit
  • Shipped at least one ISO 27001 certification from kickoff to issued certificate (Stage 1 and Stage 2 with a real registrar)
  • Fluent in Vanta (or Drata, Secureframe, Sprinto) at integration/admin level (connectors, custom tests, evidence debugging)
  • Ability to translate cloud-security language to auditor language and back without loss of precision (read Wiz findings, Panther rules, IAM policies, map to controls)
  • Writes controls as code or queries evidence with SQL when needed (Python, SQL, shell)
  • Knows difference between missing a control and having a compensating control, without fabricating alternatives
  • Direct experience with customer-trust surface: SIG, CAIQ, enterprise questionnaires, on-site auditor sessions, disclosure letters under legal review

Skills

Required:SOC 2 Type 2 program managementISO 27001 implementationControls-as-codeEvidence automation / SQL
Nice to have:Vendor risk / third-party risk

Benefits

  • Bi-annual performance bonus structure
  • Generous equity grant vested over 4 years
  • Up to $15k relocation bonus
  • $10K housing bonus (within 0.5 miles of office)
  • $1.5K monthly stipend for meals
  • Free Equinox membership
  • $200 monthly laundry reimbursement
  • $200 monthly personal wellness reimbursement
  • Health, Dental, Vision insurance
Last updated Sep 23, 2026. Interested? Apply on the company site.

About Mercor

Shape the future of work

Find top-tier, remote, AI roles for your expertise. Available only on Mercor.

AIremotejobstechnology
Company profileWebsite

More open roles at Mercor