Information Security and GRC Manager

About the role

Howdy, I'm JJ Scribe's Head of Legal! I spend my days making sure the promises Scribe makes to customers are ones we can keep, and I'm looking for the person who makes sure our security team keeps them too. We take the work seriously but not ourselves, and I think the best colleagues still have time for hobbies and families (and the occasional unread Slack!).

I'm invested in making sure you grow your expertise and your career with the function the whole way. Come do the best work of your career with me!

TL;DR - Why This Role Matters

Scribe is scaling fast, and our security and compliance program needs to keep up. As Information Security & GRC Manager, you'll be the hands-on owner of day-to-day security and compliance work. That means running our SOC 2 program, handling enterprise security reviews, driving remediation with Engineering, and operating our core internal controls. If this seat is empty, audits slip, security questionnaires pile up, enterprise deals wait on answers, and compliance requirements never become real engineering work.

About the Role

As Information Security & GRC Manager, you'll execute and operate Scribe's security and compliance program across assurance, customer security, risk management, and internal security operations. Concretely, you'll:

• Run our SOC 2 program end to end. This covers control ownership, evidence collection, auditor management, and closing gaps, so that our compliance reflects real security practice rather than paperwork. You'll also support additional frameworks as customer demand requires.
• Own customer security reviews. You'll complete questionnaires, maintain our trust center and security documentation, and lead security calls alongside Sales, Customer Success, and Legal.
• Give Legal technical input on the security commitments in customer contracts (MSAs, DPAs, BAAs, AI terms), and flag non-standard requests for a decision.
• Maintain the risk register, security policies, and vendor security review process. When you see risks, bring them to leadership with clear recommendations, and say what needs fixing now and what can reasonably wait.
• Turn audit findings, control requirements, and security issues into concrete engineering work, and track that work to completion.
• Operate and scale core internal security programs: access reviews, security awareness training, endpoint and device management, vulnerability management, and incident response readiness.

What Makes You a Great Fit

• 6+ years of experience in information security, GRC, or security compliance at a SaaS or technology company with 2+ years managing individual contributors.
• Hands-on experience running SOC 2 Type II audits, as the person who actually did the work rather than an occasional contributor.
• Experience handling enterprise customer security reviews and questionnaires alongside Sales, Customer Success, and Legal.
• Enough working knowledge of cloud security, identity and access management, endpoint security, and vulnerability management to engage credibly with engineers and push remediation forward.
• Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe).
• Sound judgment about risk: you can tell what needs immediate attention from what can wait, and you escalate the right things.
• Strong organization and follow-through, and comfort working without a large team around you.
• Experience with information security and privacy frameworks like ISO 27001, HIPAA, FERPA, public-sector requirements, and AI governance frameworks (e.g., EU AI Act, ISO 42001).
• CISSP, CISM, or CISA certification preferred.

If you're reading this thinking "that's me!", we want to meet you!

This Role Is Not for You If

• You don't have experience scaling or executing on a security team at a global SaaS or technology company.
• You haven't personally engaged in commercial/GTM negotiations and other processes, or run audits, answered security questionnaires, or driven remediation work.
• You treat every finding as requiring maximum mitigation regardless of business context.
• You need a fully defined playbook. The program is still maturing, and you'll help build the processes you run.

Compensation & Location

Salary and office requirements vary by location. All full-time employees receive equity in Scribe. Final offers depend on experience and scope.

Remote in the US or hybrid based out of our San Francisco HQ. We work from the office 3 days per week, with Mondays and Wednesdays being anchor days.

Benefits

• Healthcare Coverage - Comprehensive health, dental, and vision plans, including two $0/month medical plan options for employees
• Equity - Ownership in what we're building
• 401(k) Plan - through Vestwell
• Flex Benefit - $500/year for home office equipment, productivity tools, learning & development or fitness/wellness
• Commuter Benefits - $100/month for SF based employees
• PTO - Flexible paid time off and company holidays
• Parental Leave - Paid leave to support growing families
• Wellness & Family Support - Free Talkspace membership, One Medical access (location-dependent), and Kindbody discounts for family planning