GRC Lead for AI Security: SOC 2 & ISO 27001

Replit; Foster City (CA); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

401(k) program

Health insurance

Dental insurance

Vision insurance

Life insurance

Paid leave

Flexible time off

Commuter benefits

Wellness stipend

Autonomous work environment

In-office setup reimbursement

Quarterly team gatherings

In-office amenities

Job summary

Replit is seeking a Risk & Compliance lead to own the certification and audit program end to end, including SOC 2, ISO 27001, and future frameworks. You will manage the master security risk register, monitor compliance in real-time, and partner with Engineering to ensure controls work in practice.

You will also support GDPR/privacy initiatives with Legal/Privacy teams. The role reports to Head of Security GRC and lives in a high-impact security environment at the Foster City, CA office, with

Qualifications

• 8+ years in security compliance, IT audit, or GRC roles.
• Own at least one SOC 2 and/or ISO 27001 certification cycle.
• Working knowledge of SOC 2, ISO 27001, and NIST CSF.
• Hands-on experience authoring or maintaining ISMS/SSP documentation.
• Experience owning a formal risk register and reporting to leadership.
• Experience with GRC automation platforms and external auditors.
• Familiarity with GDPR/privacy fundamentals.

Responsibilities

• Own end-to-end certification roadmap (SOC 2 Type II, ISO 27001, future ISO 42001).
• Manage relationships with external auditors and schedule annual audits.
• Maintain master security risk register including scoring and remediation.
• Build and maintain continuous compliance monitoring reflecting real-time state.
• Own audit artifacts (ISMS docs, SoA, risk assessments, SSPs).
• Run audits, readiness assessments, and track remediation to closure.
• Support GDPR/privacy compliance with Legal/Privacy team.
• Collaborate with GRC Engineer on automation vs manual review.
• Track and report compliance posture and audit findings to leadership.

Skills

Security compliance

GRC

Audit management

ISMS/SSP

GDPR/privacy

Auditors coordination

Technical control discussion

Tools

Anecdotes

Vanta

Drata

Job description

Replit is seeking a Risk & Compliance lead to own the certification and audit program end to end, including SOC 2, ISO 27001, and future frameworks. You will manage the master security risk register, monitor compliance in real-time, and partner with Engineering to ensure controls work in practice.

You will also support GDPR/privacy initiatives with Legal/Privacy teams. The role reports to Head of Security GRC and lives in a high-impact security environment at the Foster City, CA office, with