← All roles

Director, Governance, Risk & Compliance

Doppel· General & Administrative
Apply on company site
RemoteFull-timePosted 3w ago

About the role

Director responsible for leading Doppel's GRC function, setting strategy and roadmap for governance, risk, privacy, third-party risk, control assurance, and customer trust across a rapidly scaling, cloud-first environment.

Responsibilities

  • Set the GRC strategy: Define and execute Doppel's multi-year GRC strategy, operating model, and roadmap. Establish priorities, investment areas, tooling and automation strategy, KPIs, and governance mechanisms that allow the function to scale with the business.
  • Build and lead the GRC organization: Lead, develop, and grow a high-performing GRC team. Define organizational structure, roles, ownership, and career paths; hire and develop talent; establish clear accountability; and build future leaders as the function expands.
  • Own compliance and certification strategy: Maintain executive accountability for SOC 2 Type II, ISO 27001, ISO 27701, ISO 42001, and future frameworks required by the business. Establish the approach to audit readiness, management systems, control ownership, remediation, and external auditor relationships while ensuring the team can execute certification programs effectively.
  • Lead enterprise risk governance: Establish and evolve enterprise and security risk management framework, including risk appetite, assessment methodology, escalation thresholds, risk acceptance, and executive review.
  • Scale control assurance and security governance: Set strategy for common control framework and continuous assurance across ISO, SOC 2, NIST, privacy, and other requirements; governance for testing, access risk, exceptions, remediation, and evidence quality with automation.
  • Own third-party and emerging risk strategy: Establish governance for vendor, partner, and AI-related risk, including due diligence, contractual requirements, monitoring, and escalation.
  • Lead customer trust strategy: Own security and privacy assurance strategy for customers, including diligence, Trust Center content, security reviews, and RFP support; partner with Sales/Customer Success to reduce friction in enterprise deals.
  • Shape privacy and AI governance: Partner with Legal, Product, Engineering, and Security to establish scalable privacy and responsible AI governance; evolve PIA, data governance, and ISO 42001 with product/regulatory changes.
  • Strengthen organizational resilience: Oversee incident preparedness, business continuity, disaster recovery, and remediation oversight.
  • Advise executives and the board: Deliver clear reporting on risk, compliance posture, control effectiveness, third-party risk, and certification status.

Qualifications

  • 10+ years of experience across GRC, security risk, compliance, security audit, or related disciplines with leadership of GRC or broad programs
  • Experience building and scaling GRC programs and teams in high-growth tech/SaaS/cybersecurity environments
  • Strategic advisor to senior executives translating security/compliance risk into business decisions
  • Executive ownership of SOC 2 Type II and ISO 27001 through multiple cycles; familiarity with ISO 27701, ISO 42001 preferred
  • Deep understanding of ISMS/PIMS/AIMS, Trust Services Criteria, common control frameworks, and evidence in cloud-first environments
  • Experience designing enterprise risk management programs (risk appetite, registers, governance forums, remediation)
  • Experience overseeing third-party risk, privacy, customer security assurance at scale
  • Track record building high-performing teams and evolving org structure with growth
  • Experience developing GRC tooling and automation to reduce manual work
  • Strong executive communication and influence skills with auditors/boards/customers
  • Ability to operate in ambiguity and build durable systems in scaling environment
  • Certifications such as CISA, CISSP, CISM, CRISC, ISO 27001 Lead Auditor/Implementer, CIPP, or CIPM are a plus

Skills

Required:GRC program managementSOC 2 Type II, ISO 27001 (and related frameworks)Enterprise risk managementThird-party risk and vendor managementCommunication to executives and boards
Nice to have:Privacy and AI governance

Benefits

  • Not specified in the description
Last updated Oct 1, 2026. Interested? Apply on the company site.
Doppel logo

About Doppel

The world's first platform for Social Engineering Defense.

By pairing cutting-edge AI with expert analysis, we outpace threats like phishing, impersonation, and disinformation—delivering comprehensive coverage, speed, and precision.

Social Engineering DefenseAI securityThreat intelligenceBrand protectionExecutive protectionSocial engineering
Company profileWebsite

More open roles at Doppel