GRC Manager

The role

The GRC Manager will build, support, and enhance security governance, compliance, and privacy programs. This person will work with Engineering, Product, Security, and Legal to define compliance requirements and drive implementation. They will also lead customer assurance efforts and contribute to risk management, audits, and vendor assessments.

What you will do

• Translate regulatory, framework, and customer requirements into product requirements and technical controls.
• Design, implement, and maintain security governance frameworks, policies, and procedures.
• Build and manage the company-wide risk assessment program.
• Support efforts to achieve and maintain compliance with SOC 2, ISO 27001/27701, HIPAA, FedRAMP and other standards.
• Coordinate external audits and certification processes.
• Oversee vendor security assessments.
• Partner with Engineering, Product, and Operations teams to embed compliance into operations.
• Support customer security questionnaires, due diligence efforts, and documentation requests.
• Develop and deliver security and compliance training.
• Stay current on evolving regulatory requirements and lead initiatives to mature programs.

Required qualifications

• BS Degree in CS, CE, MIS or equivalent field
• 5+ years of experience in GRC, Security Compliance, or Information Security roles
• Strong understanding of security frameworks and standards such as SOC 2, ISO 27001, NIST, and GDPR
• Proven track record managing compliance audits and certification programs end-to-end
• Experience working directly with leaders and executives within Enterprise organizations
• Experience working cross-functionally with technical and non-technical stakeholders to implement compliance and security controls
• Proven experience driving product compliance by translating regulatory and customer requirements into actionable product controls
• Experience defining project requirements and driving implementation
• Experience responding to customer security questionnaires and leading customer security interviews
• Ability to thrive in a fast-paced, high-growth startup environment

Nice to have

• Experience with cloud security compliance in AWS or GCP environments
• Hands-on experience using GRC tools (e.g., Vanta, Drata, Secureframe, Anecdotes)
• Understanding of AI/ML security considerations, data privacy, and model governance
• Previous experience building and implementing security controls in an early-stage or rapidly growing startup
• Relevant certifications (e.g., CISA, CISSP, CISM, ISO 27001 Lead Implementer)

Benefits

• Competitive compensation, including meaningful equity
• 100% coverage of medical, dental, and vision insurance for employee and dependents (U.S. only)
• Flexible PTO policy including company wide Winter Break
• Paid parental leave
• Fertility and family-building stipend through Carrot
• Company-facilitated 401(k) (U.S. only)
• Exposure to a variety of ML startups

About the company

Baseten powers mission-critical inference for the world's most dynamic AI companies. They enable companies operating at the frontier of AI to bring cutting-edge models into production.