Blitzy
Staff GRC Specialist
Cambridge, MA. Posted 8 days ago
The role
You will run compliance programs including SOC 2 Type II and ISO 27001. You will operate Vanta as a system of record and partner with the Head of GRC to design compliance processes.
What you will do
- Lead core compliance assurance programs including SOC 2 Type II and ISO 27001:2022 readiness end to end.
- Manage auditor and partner relationships directly.
- Own the automated GRC platform as the system of record.
- Design and build compliance processes that do not exist yet.
- Evaluate evidence critically.
- Set the standard for security questionnaire and customer compliance responses.
- Contribute to defining strategic governance and compliance vision and plans.
- Contribute to third party and vendor risk management, customer trust, sales enablement and BC/DR governance.
Required qualifications
- 10+ years of experience in compliance assurance, controls and technology risk management.
- Bachelor’s in information system, computer science or a related field.
- Personal, hands-on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle.
- Direct experience running an automated GRC/compliance platform (Vanta or equivalent) as a primary owner.
- Track record of managing multiple compliance initiatives at once.
- Experience navigating auditor, stakeholder and vendor relationships independently.
- Seniority and judgment to reduce stakeholder interrupt load.
- Clear writing for policies, audit narratives, and questionnaire responses.
- Experience mentoring teammates or setting working standards for others.
Nice to have
- Vendor risk management experience
- Customer trust experience (security questionnaires and sales enablement)
- Prior work at an early stage/high growth tech company
- FedRAMP exposure at any level
- A track record of building a compliance process from scratch
- Experience managing multiple frameworks concurrently
- CISSP, CISA or CISM certification
About the company
Blitzy is a Cambridge, MA based AI software development platform. It uses an agentic software development platform to autonomously execute software development work.