GRC Manager

The role

The GRC Manager owns G2's day-to-day security compliance and risk program. This senior individual-contributor role manages customer security questionnaires, vendor risk reviews, policy governance, DSAR processing, audit management, and risk register maintenance.

What you will do

• Administer G2's security policy library and lead the annual review cycle.
• Lead response to customer and prospect security questionnaires.
• Own G2's public Trust Center and serve as the front-line representative to customers.
• Run the third-party/vendor risk management program.
• Manage data subject access request (DSAR) intake and fulfillment.
• Support security addendum and contract redlines with Legal.
• Maintain and mature enterprise risk registers across business functions.
• Lead SOC 2 Type II and ISO 27001 audit cycles end-to-end.
• Manage the GRC tooling and vendor ecosystem.
• Build and deliver executive-level dashboards and reporting on program health.

Required qualifications

• 7–10 years of progressive experience in IT Governance, Risk, and Compliance or information security, including direct ownership of a compliance program.
• Deep working knowledge of SOC 2 Type II, ISO 27001, NIST CSF, and common SaaS/cloud security and privacy frameworks (e.g., PCI DSS, GDPR, CCPA).
• Hands-on experience with a modern GRC/compliance automation platform (e.g., Vanta, Drata, OneTrust, or similar).
• Proven experience managing high-volume customer security questionnaires and knowledge-library programs.
• Experience running a third-party/vendor risk management program, including risk scoring and remediation tracking.
• Experience managing DSAR or other privacy request workflows in line with regulatory timelines.
• Track record serving as primary point of contact for external auditors through full audit cycles.
• Excellent written and verbal communication skills.
• Strong prioritization and program-management skills.
• Demonstrated ability to influence and align cross-functional partners without formal authority.

Nice to have

• CISSP, CRISC, CISM, or CISA certification.
• Experience leading an organization through initial ISO 27001 certification or a comparable new-framework rollout.
• Familiarity with procurement-to-GRC integrations and automating vendor intake into a risk workflow.
• Working knowledge of global privacy regulations (GDPR, CCPA, LGPD) and experience partnering with Legal on data protection matters.
• Experience managing a GRC program budget and vendor/contract relationships.
• Track record operating as a senior individual contributor who drives outcomes through influence and cross-functional partnership.

About the company

G2 is the world's largest and most trusted software marketplace. It has joined forces with Capterra, SoftwareAdvice, and GetApp to create a large source of online data and software insights.