← All roles

Information Security and GRC Manager

Scribe· Security & Compliance
Apply on company site
Hybrid (San Francisco), Hybrid (United States)Full-timePosted 1w ago

About the role

Information Security & GRC Manager responsible for running Scribe's security and compliance program, including SOC 2, customer security reviews, risk management, internal controls, and incident readiness in a hybrid, SF-based setting.

Responsibilities

  • - Run our SOC 2 program end to end, including control ownership, evidence collection, auditor management, and gap remediation; support additional frameworks as needed.
  • - Own customer security reviews: complete questionnaires, maintain trust center and security docs, lead security calls with Sales, Customer Success, and Legal.
  • - Provide Legal technical input on security commitments in customer contracts (MSAs, DPAs, BAAs, AI terms) and flag non-standard requests.
  • - Maintain the risk register, security policies, and vendor security review process; raise risks with leadership with clear recommendations.
  • - Translate audit findings and security requirements into concrete engineering work and track to completion.
  • - Operate and scale core internal security programs: access reviews, security awareness training, endpoint management, vulnerability management, and incident response readiness.

Qualifications

  • - 6+ years in information security, GRC, or security compliance at a SaaS/tech company; 2+ years managing individual contributors
  • - Hands-on experience running SOC 2 Type II audits
  • - Experience handling enterprise customer security reviews and questionnaires with cross-functional teams
  • - Knowledge of cloud security, IAM, endpoint security, vulnerability management; ability to engage with engineers
  • - Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe)
  • - Risk judgment and ability to prioritize; strong organization and independent work capability
  • - Experience with ISO 27001, HIPAA, FERPA, public-sector requirements, AI governance frameworks (EU AI Act, ISO 42001)
  • - CISSP, CISM, or CISA certification preferred

Skills

Required:SOC 2 Type II auditsCustomer security reviewsCloud securityIdentity and access managementVulnerability management
Nice to have:GRC automation platforms

Benefits

  • - Healthcare Coverage – Comprehensive health, dental, and vision plans with two $0/month medical plan options
  • - Equity – Ownership in the company
  • - 401(k) Plan – through Vestwell
  • - Flex Benefit – $500/year for home office equipment, productivity tools, learning & development, or fitness/wellness
  • - Commuter Benefits – $100/month for SF-based employees
  • - PTO – Flexible paid time off and company holidays
  • - Parental Leave – Paid leave for growing families
  • - Wellness & Family Support – Free Talkspace, One Medical (location-dependent), and Kindbody discounts for family planning
Last updated Oct 21, 2026. Interested? Apply on the company site.

About Scribe

Create Step-by-Step Guides — Fast.

Scribe documents your processes for you. Build visual guides with text, links and screenshots instantly.

productdocumentationworkflowSOPsai
Company profileWebsite

More open roles at Scribe