Staff GRC Specialist

How we work

• We move Blitzy Fast: Time is both our company’s and our clients’ most precious asset. We move quickly and decisively to innovate internally and deliver exceptional software externally.
• Championship Mindset: We operate like a professional sports team. We win as a team by holding ourselves and each other to high standards, collaborating in-person, and remaining focused on the mission.
• Passion for Invention: We’re pushing the frontier of what’s possible, requiring constant innovation and iteration.
• We Work for the Customer: We focus on delivering outsized value to the customers we work with and expanding those relationships into deep, meaningful partnerships.

About the Role

We're looking for a Staff GRC Specialist to join our GRC team and help run a compliance program that's audit-ready by design, not by scramble. In this role, you'll partner with the Head of GRC to own execution of our existing SOC 2 Type II and ISO 27001 and any future programs end to end, operate Vanta as our system of record, and lead our day-to-day work with internal stakeholders, auditors and compliance partners.

You'll work closely with engineering to cut the interrupt load of security questions and evidence requests, and you'll help teammates do the same. You'll also have the opportunity to design the compliance processes that don't exist yet and to help drive our FedRAMP effort, one of the most demanding compliance programs a company can pursue.

Our interview process reflects the role itself: a control design and an audit management process walkthrough where you'll talk through a real experience you've had.

Responsibilities

• Lead core compliance assurance programs, including SOC 2 Type II and ISO 27001:2022 readiness end to end, building continuously toward a well executed and low stakeholder impact audit program.
• Manage auditor and partner relationships directly, keeping management informed on scope and findings.
• Own the automated GRC platform as the system of record - configuring tests, keeping evidence current, and closing gaps before they become findings.
• Design and build the compliance processes that don't exist yet
• Evaluate evidence critically rather than take it at face value
• Set the standard for security questionnaire and customer compliance responses, taking questions and evidence requests off internal stakeholder's plate and coaching teammates to do the same.
• Contribute to defining the strategic governance and compliance vision and plans aligned with general Blitzy business priorities
• Contribute, support and eventually drive some of the wide range of GRC responsibilities, including third party and vendor risk management, customer trust and sales enablement and BC/DR governance.

Qualifications

Required

• 10+ years of experience in compliance assurance, controls and technology risk management.
• Bachelor’s in information system, computer science or a related field.
• Personal, hands-on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle - not just adjacent to one.
• Direct experience running an automated GRC/compliance platform (Vanta or equivalent) as a primary owner.
• A track record of managing multiple compliance initiatives at once as well as navigating auditor, stakeholder and vendor relationships independently, with sound judgment on when to escalate.
• The seniority and judgment to reduce stakeholder interrupt load, not add to it.
• Clear writing - policies, audit narratives, and questionnaire responses that hold up under scrutiny.
• Experience mentoring teammates or setting working standards for others.

Nice to Have

• Vendor risk management experience
• Customer trust experience (security questionnaires and sales enablement)
• Prior work at an early stage/high growth tech company
• FedRAMP exposure at any level.
• A track record of building a compliance process from scratch, not just running an existing playbook.
• Experience managing multiple frameworks concurrently
• CISSP, CISA or CISM certification

Compensation

$160,000 -$240,000 + Bonus + Equity

We believe different perspectives make us stronger. Base salary ranges are determined by country, role, level, experience, and skills. The range displayed on each job posting reflects Blitzy’s good faith determination of the minimum and maximum targets for new hire salaries across all locations. Individual pay is determined by related factors, including job skills, experience, and relevant education or training, which may impact a final offer. Your Talent Partner can share more about the specific salary range during the hiring process