GRC Analyst: Scale AI Security & Compliance

Fluidstack; San Francisco (CA); On-site; USD 218,000 - 269,000; Full time

Benefits offered by this job

Equity

Health, dental, and vision insurance

Generous PTO

Retirement plan

Job summary

Fluidstack is seeking a Security Compliance Lead in San Francisco to own end-to-end controls across SOC 2 Type II, ISO 27001, NIST 800-53, and FedRAMP, building a scalable program for global sites.

You will collaborate with engineering and operations to gather evidence, manage audit readiness, and close findings with external auditors, while aligning policy with evolving regulatory requirements.

Qualifications

• Experience leading controls and pulling evidence against one or more security frameworks (SOC 2, ISO 27001, NIST 800-53, or FedRAMP).
• Proven ability to own a compliance documentation set, policies, procedures, and narratives and keep them current.
• Experience defending controls in front of auditors and closing findings without escalation.
• Ability to drive evidence collection from busy engineers and owners across the organization on time.

Responsibilities

• Run end-to-end SOC 2 Type II, ISO 27001, NIST 800-53, or FedRAMP initiatives and audit preparation.
• Own policy and procedure sets; maintain review cycles as the program grows.
• Coordinate control operations, access reviews, evidence refreshes, and attestations with system owners.
• Lead POA&M management and closure with external auditors and assessors.
• Scale the program to new sites and teams, mapping systems to existing controls for consistent coverage.

Skills

SOC 2

ISO 27001

NIST 800-53

FedRAMP

Audit management

Policy writing

Evidence collection

Cross-functional collaboration

Tools

Vanta

Job description

Fluidstack is seeking a Security Compliance Lead in San Francisco to own end-to-end controls across SOC 2 Type II, ISO 27001, NIST 800-53, and FedRAMP, building a scalable program for global sites.

You will collaborate with engineering and operations to gather evidence, manage audit readiness, and close findings with external auditors, while aligning policy with evolving regulatory requirements.