GRC Lead: End-to-End Certifications & Audits

Thinking Machines Lab Inc.; San Francisco (CA); On-site; USD 225,000 - 350,000; Full time

Benefits offered by this job

Health benefits

Dental benefits

Vision benefits

Unlimited PTO

Parental leave

Relocation support

Job summary

Thinking Machines Lab, based in San Francisco, is seeking a GRC Lead to drive certifications (SOC 2, ISO 27001, FedRAMP) from scoping to audit close. You’ll collect evidence, write control docs, and interface directly with auditors, while collaborating with security, legal, and engineering.

You’ll manage governance, risk, and compliance programs day-to-day, build a year-one roadmap for GRC, and translate regulatory requirements into concrete, auditable controls across infrastructure and data

Qualifications

• 7+ years in technology cybersecurity GRC (Governance, Risk, and Compliance).
• Experience leading SOC 2, ISO 27001, FedRAMP or comparable certifications from scoping to audit close.
• Hands-on experience collecting audit evidence and writing control documentation.
• Experience managing recurring compliance processes such as control testing and risk register maintenance.
• Ability translate complex compliance requirements to non-technical stakeholders; adaptable to new tech domains.

Responsibilities

• Own certification roadmap end to end: scope, control set, evidence collection, and auditor liaison.
• Manage recurring compliance processes (control testing, audit prep, risk register maintenance, policy attestations).
• Answer compliance questions from engineering, security, and product teams with technical fluency across infrastructure and data handling.
• Track GDPR, EU AI Act and similar requirements; translate into actionable controls.
• Identify gaps when new products/infrastructure/jurisdictions are added; propose changes.
• Build and maintain tooling/documentation to accelerate future audits.
• Plan multi-quarter roadmap for GRC while running existing certifications.

Skills

GRC Expertise

Audits & Certifications

Evidence collection

Risk assessment

Cross-functional collaboration

Tools

Audit tooling

Job description

Thinking Machines Lab, based in San Francisco, is seeking a GRC Lead to drive certifications (SOC 2, ISO 27001, FedRAMP) from scoping to audit close. You’ll collect evidence, write control docs, and interface directly with auditors, while collaborating with security, legal, and engineering.

You’ll manage governance, risk, and compliance programs day-to-day, build a year-one roadmap for GRC, and translate regulatory requirements into concrete, auditable controls across infrastructure and data