GRC Lead — AI Governance & Enterprise Security

Aaru; New York (NY); On-site; USD 140,000 - 190,000; Full time

Benefits offered by this job

Medical coverage

Vision coverage

Dental coverage

Visa sponsorship

Relocation support

Equity participation

Job summary

Aaru in New York City is expanding its governance, risk, and compliance team and is seeking a dedicated GRC Lead to own the program. You will drive enterprise security reviews, audit readiness, and policy governance with an emphasis on automation and scalable processes.

You will partner with engineering, legal, and product teams to manage third‑party risk, implement AI governance, and ensure controls are understood and adhered to across the organization.

Qualifications

• 5–8 years in GRC, security compliance, or IT audit, ideally at a company selling into enterprise.
• Familiarity with SOC 2, ISO 27001, NIST CSF, HIPAA, or PCI-DSS.
• Experience with automation for evidence collection and controls.
• Experience applying AI governance frameworks or AI risk management concepts.

Responsibilities

• Lead security questionnaires, due diligence, and RFP sections; represent security posture to customers and vendors.
• Manage external audits, readiness activities, and remediation tracking.
• Run control testing, access reviews, and monitoring with defined timelines.
• Automate evidence collection and governance workflows in the GRC platform.
• Oversee third-party risk programs, vendor assessments, and policy enforcement across procurement.

Skills

GRC experience

Security compliance

IT audit

SOC 2 familiarity

ISO 27001 familiarity

NIST CSF familiarity

HIPAA

PCI-DSS

Vanta/Drata/OneTrust

AI governance

Job description

Aaru in New York City is expanding its governance, risk, and compliance team and is seeking a dedicated GRC Lead to own the program. You will drive enterprise security reviews, audit readiness, and policy governance with an emphasis on automation and scalable processes.

You will partner with engineering, legal, and product teams to manage third‑party risk, implement AI governance, and ensure controls are understood and adhered to across the organization.