Director of GRC: Enterprise Security & Trust Strategy

Hyperproof; Seattle (WA); On-site; USD 146,000 - 206,000; Full time

Job summary

Hyperproof in Seattle, WA seeks a Director of GRC to transform compliance into a Continuous Assurance engine. You will own end-to-end programs for SOC 2 Type II, FedRAMP Moderate, and emerging standards, engage with 3PAOs and Fortune 500 security teams, and align GRC with revenue through trusted governance.

You will lead security awareness, third-party risk, incident response governance, data privacy, and secure SDLC integration.

Qualifications

• CISSP certification is strictly required.
• 8+ years in GRC or information security leadership within a high-growth SaaS environment.
• Direct experience with FedRAMP Moderate ATO and deep knowledge of NIST 800-53 controls.
• Ability to discuss cloud architecture, IAM, and containerization with senior engineers.
• Strong executive presence for board and customer reporting.

Responsibilities

• Audit Ownership: lead end-to-end strategy for SOC 2 Type II and FedRAMP Moderate authorizations with 3PAO liaison.
• Strategic Roadmap: expand the program into ISO 27001, NIST AI RMF, and other standards.
• External Trust & Third-Party Governance: manage questionnaires and Trust Center for sales cycles.
• Incident Response & Operational Resilience: lead IR playbooks and annual tabletop exercises.
• Data Privacy & Risk Strategy: oversee GDPR/US privacy compliance and risk registers.
• Secure Software Development: embed security controls across the SDLC and vulnerability management.

Skills

GRC leadership

Executive communication

Security leadership

Tools

AWS

Azure

IAM

Containers

Job description

Hyperproof in Seattle, WA seeks a Director of GRC to transform compliance into a Continuous Assurance engine. You will own end-to-end programs for SOC 2 Type II, FedRAMP Moderate, and emerging standards, engage with 3PAOs and Fortune 500 security teams, and align GRC with revenue through trusted governance.

You will lead security awareness, third-party risk, incident response governance, data privacy, and secure SDLC integration.