Product GRC SME

Vanta; Deutschland; Vor Ort; EUR 70.000 - 90.000; Vollzeit

Zusammenfassung

Vanta is seeking a GRC Subject Matter Expert to help develop and maintain compliance frameworks such as SOC2, ISO, HIPAA, and GDPR. You will design crosswalks between regulations, enhance content quality, and collaborate with multiple internal teams including Engineering and Product Management.

The ideal candidate thrives on solving complex problems, has a strong understanding of security and privacy regulations, and enjoys making a real impact for customers.

Qualifikationen

• Experience in developing compliance frameworks and controls.
• Ability to manage multiple stakeholders and contribute to product strategy.
• Strong understanding of security and privacy regulations.

Aufgaben

• Build and maintain compliance frameworks for various standards.
• Design crosswalks and mappings between regulatory frameworks.
• Elevate content quality and usability through standards and QA processes.

Kenntnisse

Building compliance frameworks

Designing crosswalks with industry standards

Content quality elevation

Understanding of security frameworks (SOC2, ISO, NIST)

Stakeholder management

Jobbeschreibung

At Vanta, our mission is to help businesses earn and prove trust. We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it.

As Vanta rapidly grows and moves upmarket, we’re working with increasingly sophisticated customers who have complex security and compliance needs across a wide range of industries and geographies. The GRC Subject Matter Experts play a critical role in delivering high-quality, scalable content and product guidance to help these companies effectively manage their GRC programs.

As Vanta’s newest GRC Subject Matter Expert, you’ll be responsible for developing and maintaining multi-framework GRC solutions used by thousands of customers. Acting as a bridge between Product Management, Engineering, Design, Sales, and Customer Success, you’ll ensure our solutions align with key security, privacy, and risk frameworks and real-world customer needs. You’ll play a pivotal role in designing, validating, and improving compliance-related content and capabilities while providing strategic input to shape Vanta’s GRC product roadmap.

You’ll join Vanta’s Security organization, which provides essential security operational services, is directly involved in the software development process, sets policies and standards regarding enterprise-wide security requirements, and offers advisory services to enable our business to thrive while effectively managing risk. If you’re someone who has high initiative and enjoys solving complex problems with real customer impact, we’d love to hear from you!

What you’ll do as a GRC SME at Vanta:

• Build and maintain compliance frameworks – Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for standards such as SOC2, ISO/IEC27001 & 27701, HIPAA, PCIDSS, NISTCSF, NISTSP800-53, and regional regulations (e.g., GDPR/CCPA). Author clear control rationales, acceptance criteria, and customer‑facing guidance.
• Design crosswalks and mappings (framework‑agnostic) – Create and steward an internal common‑control approach informed by industry catalogs (e.g., SCF, UCF, or similar). Maintain bidirectional crosswalks across industry leading security and privacy regulatory frameworks. Define canonical control IDs, mapping confidence, and evidence data dictionaries; version crosswalks with changelogs and traceability to source authority. Partner with Engineering to operationalize mappings in‑product (integrations, automated tests, exceptions/exemptions, continuous monitoring workflows).
• Elevate content quality and usability – Define standards for control wording, evidence specificity, testing method, and reviewer guidance. Establish content QA processes, audits, and metrics (e.g., adoption, time‑to‑evidence, completion rates).