GRC Specialist

The role

You will manage day-to-day GRC operations, risk management, and third-party risk. You will also design internal audits and maintain the policy library to support compliance frameworks.

What you will do

• Own day-to-day GRC operations including user access reviews, security awareness, and JML tracking
• Run the risk management program and maintain the risk register
• Manage third-party risk through vendor and subprocessor assessments
• Design and execute targeted internal audits and support external audit cycles
• Own continuous control monitoring and evidence automation via a GRC platform
• Build and foster relationships with cross-functional partners
• Partner with control owners to educate them on responsibilities
• Keep the policy library current
• Translate program data into insights and metrics for leadership
• Take on additional GRC projects as the program evolves

Required qualifications

• 5-7 years of experience in GRC, IT audit, information security, or a closely related field
• Working knowledge of major security and privacy frameworks such as SOC 2, ISO 27001/27701/42001, NIST CSF, HIPAA, GDPR, or CCPA
• Experience with GRC platforms (Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC)
• Experience running user access reviews and a solid understanding of identity and access management concepts (RBAC, least privilege, segregation of duties, JML processes)
• Hands-on experience administering a security awareness or phishing simulation platform (Adaptive Security, KnowBe4, Hoxhunt, Proofpoint, or similar)
• Comfort with cloud environments (AWS, GCP, or Azure) and how SaaS products are built and operated
• Strong written communication
• Detail-oriented and organized

About the company

Fireworks is a platform for specialized intelligence that enables companies to build, train, and serve AI models. It is a Series D company valued at $17.5 billion.