GRC Lead: AI Governance & Enterprise Security

association of arab universities; New York (NY); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Equity participation

Medical, vision, dental coverage

Visa sponsorship

Relocation support

Other benefits

Job summary

Aaru in New York City is seeking a GRC Lead to own governance, risk, and compliance end-to-end. This is a build role focused on automating evidence collection, security reviews, and control testing for enterprise customers.

You will collaborate with engineering, product, and legal to ensure data protection, vendor risk, and AI governance, shaping a scalable program from the ground up and enabling faster, safer deals.

Qualifications

• 5–8 years in GRC, security compliance, or IT audit.
• Experience with SOC 2 and familiarity with ISO 27001, NIST CSF, HIPAA, or PCI-DSS.
• Used Vanta, Drata, OneTrust to automate evidence collection.
• You use AI tools for substantive work and validate output before shipment.
• Supported live sales cycles through security review to prevent deal slippage.
• Written communication that explains controls to engineers, customers, and buyers clearly.
• Ability to build repeatable processes where none exist.

Responsibilities

• Own responses to security questionnaires and due diligence requests; represent security posture in customer conversations.
• Lead audit readiness; manage RFI responses, control walkthroughs, and remediation closures.
• Run recurring control checks, access reviews, and periodic testing; document gaps and drive fixes.
• Automate evidence collection in the GRC platform to streamline workflows.
• Build and manage vendor assessment lifecycle: questionnaires, SOC 2 and ISO reviews, risk scoring, policy enforcement.
• Own AI governance for models and agents in collaboration with engineering, product, and legal.

Skills

GRC experience

Security compliance

IT audit

SOC 2 knowledge

ISO 27001 familiarity

NIST CSF familiarity

HIPAA familiarity

PCI-DSS familiarity

AI-assisted tooling

Security questionnaires

Education

CISA/CRISC/CISM or ISO 27001 Lead Auditor/Lead Implementer

Tools

Vanta

Drata

OneTrust

Job description

Aaru in New York City is seeking a GRC Lead to own governance, risk, and compliance end-to-end. This is a build role focused on automating evidence collection, security reviews, and control testing for enterprise customers.

You will collaborate with engineering, product, and legal to ensure data protection, vendor risk, and AI governance, shaping a scalable program from the ground up and enabling faster, safer deals.