Senior GRC Lead: Risk & Compliance

The Role

As a Risk and Compliance Expert at Zania, you are the senior GRC voice our customers rely on. This is a non-technical, customer-facing domain expert role. We are looking for someone with in-depth knowledge of specific GRC domains who can serve as the ultimate compliance authority.

You will own the customer relationship post-sale, leading transformations and implementations. Because you will be interacting heavily with CISOs and VPs of Risk, you must be exceptionally structured in your communication and highly skilled at managing relationships. You will set clear success goals with every customer, drive engagements toward those milestones with urgency, and know exactly when you have landed the outcome you both committed to.

In addition to your customer-facing responsibilities, you will be the GRC depth behind our products. Everything you learn in the field driving implementations will directly shape what Zania builds, ensuring our AI agents behave accurately from a practitioner's standpoint.

What You'll Do

• Drive post-sale transformations: Lead implementations for enterprise customers from scoping and configuration through to a defined go-live. You are a closer who doesn't let engagements drift.
• Manage senior relationships: Act as the primary customer-facing GRC expert. Communicate in a highly structured way to build trust, manage expectations, and align with executive stakeholders (CISOs, VPs of Risk).
• Apply in-depth GRC methodology: Provide deep expertise in specific risk and compliance domains. When customers ask complex questions about control mappings or frameworks, you answer with precision and credibility.
• Shape product decisions: Translate what you hear during customer implementations into a prioritized, opinionated point of view for our product team.
• Ensure GRC accuracy: When an agent's output falls short of what a practitioner would accept, diagnose why from a GRC standpoint and define the fix.

Representative Projects

• Kick off a new enterprise engagement by running a structured goal-setting session with the customer's CISO and GRC lead, defining measurable success outcomes for their post-sale transformation.
• Sit with a Fortune 500 CISO and their GRC lead to work through how Zania maps to their existing control framework, driving their implementation forward.
• Run a structured review of agent output across real customer assessments, leveraging your deep domain expertise to identify failure patterns for the engineering team.

What You Have

• Deep GRC Expertise (Depth, not exposure): 5+ years of in-depth knowledge in specific risk and compliance domains, security compliance, or IT audit, with real ownership of programs.
• Non-technical domain mastery: You are an expert in GRC methodologies, not software development. You have direct professional experience applying at least two major compliance or risk frameworks (e.g., SOC 2, ISO 27001, NIST CSF, FedRAMP, HIPAA, PCI-DSS).
• Relationship Management: Executive presence and a proven ability to own relationships with senior security and risk stakeholders. You are comfortable presenting, advising, and pushing back when needed.
• Structured Communication: You are highly organized and can translate complex GRC concepts into clear, structured communication for both customers and internal teams.
• A closer's instinct: You drive post-sale implementations toward success with urgency, bringing customers to a clear finish line.

Minimum Qualifications

• Bachelor's degree in Information Security, Business, Risk Management, or a related field, or equivalent practical experience.
• 5+ years of hands-on, non-technical experience as an expert in GRC, information security compliance, risk management, or IT audit.
• Direct professional experience applying major compliance or risk frameworks (e.g., SOC 2, ISO 27001, NIST CSF, FedRAMP, HIPAA, PCI-DSS) or recognized third-party risk methodologies.
• Proven track record in a customer-facing role driving transformations, implementations, or complex post-sales engagements.
• Strong structured written and verbal communication skills, with the ability to command a room and earn trust with executive leadership.

Nice to Have

• Experience at a Big 4 or Tier 2 advisory firm (risk advisory, internal audit, or cyber practice).
• In-house GRC experience at a company that was regularly audited or assessed.
• Hands-on use of GRC platforms such as Archer, OneTrust, AuditBoard, LogicGate, or ServiceNow IRM.
• Prior customer success, implementation, or consulting experience.

Compensation & Benefits

• Competitive salary + significant equity
• Flexible PTO
• Medical, dental, and vision insurance
• Meals and snacks in the office
• Relocation and immigration support