Security Assurance & GRC Lead

The role

The Security Assurance & GRC Lead will own customer assurance and compliance programs. You will set the GRC roadmap across SOC 2, ISO 27001, privacy, and enterprise customer requirements.

What you will do

• Own the GRC roadmap including SOC 2 Type II, ISO 27001, and risk management.
• Lead customer assurance end-to-end including calls, reviews, and written responses.
• Own questionnaires, due-diligence requests, vendor assessments, and RFP security sections.
• Engage early on major opportunities to build security plans with Sales.
• Improve the Trust Center, standard responses, and security narratives.
• Standardize and automate processes using Drata, SafeBase, and Linear.
• Partner with a compliance engineer to build operating processes.
• Feed security review patterns into Product and Engineering for technical requirements.
• Own the AI security narrative regarding model providers, data usage, and retention.
• Coordinate audit evidence, track deadlines, and maintain controls and policies.

Required qualifications

• Depth in GRC, security compliance, customer assurance, IT audit, or risk management.
• Experience leading customer security reviews and explaining security to audiences.
• Working knowledge of SOC 2, ISO 27001, or similar frameworks.
• Ability to create structure around manual or ambiguous work.
• Strong written and verbal communication on risk, posture, and technical constraints.
• Project-management discipline to drive cross-functional work to completion.
• Comfort working across Engineering, Product, IT, Legal, Sales, Customer Success, and Support.

Nice to have

• Startup or growth-stage SaaS experience supporting enterprise customers.
• Experience establishing or scaling a compliance or customer assurance program.
• Familiarity with Drata, Vanta, SafeBase, or similar tools.
• Familiarity with standard questionnaires (SIG, CAIQ, HECVAT, VSAQ).
• Working knowledge of cloud security, access control, encryption, logging, vulnerability management, incident response, and SaaS architecture.
• Familiarity with AI security and privacy.
• Exposure to GDPR, CCPA, HIPAA, data residency, or vendor-risk management.
• Experience building automations or integrations for compliance work.
• Security+, CISA, CGRC, ISO 27001 Lead Implementer, or similar certification.

Before you apply

• We sponsor H1B, O1, EB1, L1, STEM OPT, and more.

About the company

Wispr is an AI research and product company building the voice interface for computing. Their products include Flow and Notetaker.