Director of GRC - Build ISO 27001 & SOC 2 (Startup)

The San Francisco Compute Company; San Francisco (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

Generous equity grant

Visa Sponsorships

Retirement matching

Medical, dental & vision

Time off

Parental leave

Daily lunch

Unlimited office book budget

Job summary

The San Francisco Compute Company is seeking a Director of GRC to own governance, risk, and compliance. You will build and lead the GRC function from day one, drive SOC 2 Type 2 and ISO 27001 initiatives, and collaborate with engineering on controls and remediation.

This build role requires startup experience and a hands-on track record delivering a first-time ISO certification, with a strong emphasis on leadership, vendor risk, and policy design.

Qualifications

• Senior, high-impact GRC or security compliance experience in a startup.
• Led or built first ISO 27001 program from readiness to audit.
• Owned or ran a SOC 2 program at scale.

Responsibilities

• <b>Team Leadership:</b> Hire, manage, and develop the GRC team from day one and set priorities.
• <b>Compliance Program Ownership:</b> Lead SOC 2 Type 2 and ISO 27001 end-to-end, including audits.
• <b>Risk Management:</b> Establish enterprise risk management, risk register, and reporting.
• <b>Policy & Process Design:</b> Create and implement access reviews, business continuity, security awareness, vendor management.
• <b>GRC Tooling:</b> Own the compliance automation platform and integration.
• <b>Third-Party Risk:</b> Conduct vendor security reviews and risk assessments.

Skills

Senior GRC role

ISO 27001 certification

SOC 2 program ownership

People leadership

Cross-functional with engineering

GRC tooling (Vanta)

Tools

Vanta

Job description

The San Francisco Compute Company is seeking a Director of GRC to own governance, risk, and compliance. You will build and lead the GRC function from day one, drive SOC 2 Type 2 and ISO 27001 initiatives, and collaborate with engineering on controls and remediation.

This build role requires startup experience and a hands-on track record delivering a first-time ISO certification, with a strong emphasis on leadership, vendor risk, and policy design.