GRC Manager

Baseten; United States; Remote; USD 140,000 - 190,000; Full time

Benefits offered by this job

Remote-first work environment

Annual team summits

Unlimited PTO

Comprehensive health coverage

Parental leave

401(k) with company match

Learning & development budget

Job summary

Baseten is seeking an experienced GRC Manager to build and continuously enhance security governance, risk, privacy, and compliance programs across the platform.

You will collaborate with Engineering, Product, Security and Legal to translate regulatory requirements into concrete product controls, drive audits and certifications, and manage vendor risk while supporting customer assurance efforts.

Qualifications

• 5+ years of experience in GRC, Security Compliance, or Information Security.
• Experience leading governance, risk management, and compliance programs.
• Ability to translate regulatory requirements into concrete controls for Product and Engineering.
• Proven track record coordinating audits and certifications end-to-end.

Responsibilities

• Lead governance, risk management, and compliance programs across Baseten.
• Coordinate internal and external security audits and certifications.
• Collaborate with Engineering, Product, Security, and Legal to embed controls into design.
• Manage vendor risk assessments and third-party security controls.
• Respond to customer security questionnaires and support assurance efforts.

Skills

GRC & information security

SOC 2 / ISO 27001 / NIST / GDPR

Vendor risk management

Security audits & certifications

Cross-functional collaboration

Security governance

Regulatory compliance

Executive communication

Education

BS degree in CS/CE/MIS or equivalent

Tools

Vanta

Drata

Secureframe

Anecdotes

Job description

• We are seeking an experienced and detail-oriented GRC (Governance, Risk, and Compliance) Manager to build, support, and continuously enhance Baseten’s security governance, compliance, and privacy programs. As one of the early members of our security organization, you will play a key role in ensuring our platform meets and exceeds the highest standards for privacy, trust, and regulatory compliance
• You’ll work closely with Engineering, Product, Security, and Legal to define compliance requirements, assess platform capabilities, and drive implementation from initial scoping through validation. You will also lead customer assurance efforts, helping customers understand our security architecture and compliance posture while bringing their requirements back into product planning
• Alongside this product focus, you’ll contribute to Baseten’s broader GRC program, including governance, risk management, audits, vendor assessments, and security awareness
• Product Compliance: Translate regulatory, framework, and customer requirements into clear product requirements and technical controls, partnering with Engineering and Product to build compliance into platform design and development
• Governance & Policy Development: Design, implement, and maintain security governance frameworks, policies, and procedures that align with Baseten’s risk posture and industry best practices
• Risk Management: Build and manage the company-wide risk assessment program, identifying, tracking, and mitigating key security and compliance risks
• Compliance Operations: Support efforts to achieve and maintain compliance with SOC 2, ISO 27001/27701, HIPAA, FedRAMP and other applicable standards and regulations
• Audit & Certification Management: Coordinate external audits and certification processes, ensuring evidence collection, control validation, and remediation plans are executed efficiently
• Third-Party Risk Management: Oversee vendor security assessments and ensure third-party providers meet Baseten’s security and compliance standards
• Cross-Functional Collaboration: Partner with Engineering, Product, and Operations teams to embed compliance and risk management into day-to-day operations and technical processes
• Customer Trust & Assurance: Support customer security questionnaires, due diligence efforts, and documentation requests from prospective and existing clients
• Training & Awareness: Develop and deliver security and compliance training to ensure company-wide understanding of key policies and responsibilities
• Continuous Improvement: Stay current on evolving regulatory requirements and lead initiatives to mature our compliance and risk management programs

Benefits

• Remote-first work environment. The Baseten team is welcome to work from wherever they want; fully remote, in our San Francisco office, or a mix of both. Today, our team (including our founding team) is spread across the United States, Canada, and Armenia. We provide a $1,000 stipend for you to make your home-office comfortable and productive
• Regular in-person team summits. We get together as a team three times a year to plan, workshop, and most importantly, get to know each other better
• Unlimited PTO. We ask that everyone take at least 4 weeks of vacation. And we have a company-wide break between Christmas and New Year’s Day
• Full healthcare coverage. Medical, dental and vision insurance for you and your family
• Paid parental leave. 16-weeks fully paid parental leave (adoptive and non-birth parents included) and flexibility with schedules while returning to work
• Company-sponsored 401(k) for you to contribute to
• Learning and development budget. We encourage you to take classes, attend conferences, and invest in your craft and we’ll cover expenses to make it happen

• Strong understanding of security frameworks and standards such as SOC 2, ISO 27001, NIST, and GDPR
• Proven track record managing compliance audits and certification programs end-to-end
• Ability to thrive in a fast-paced, high-growth startup environment while maintaining structure and process discipline
• Proven experience driving product compliance by translating regulatory and customer requirements into actionable product controls with Engineering and Product
• Experience responding to customer security questionnaires and leading customer security interviews, with the ability to clearly communicate security controls, compliance posture, and risk management practices to technical and nontechnical audiences
• BS Degree in CS, CE, MIS or equivalent field
• Experience defining project requirements and driving implementation by translating compliance objectives into clear deliverables, coordinating cross-functional stakeholders, and managing execution through completion
• 5+ years of experience in GRC, Security Compliance, or Information Security roles, ideally in a SaaS or cloud-native environment
• Experience working cross-functionally with technical and non-technical stakeholders to implement compliance and security controls
• Experience working directly with leaders and executives within Enterprise organizations
• Relevant certifications (e.g., CISA, CISSP, CISM, ISO 27001 Lead Implementer)
• Previous experience building and implementing security controls in an early-stage or rapidly growing startup
• Hands-on experience using GRC tools (e.g., Vanta, Drata, Secureframe, Anecdotes)
• Understanding of AI/ML security considerations, data privacy, and model governance
• Experience with cloud security compliance in AWS or GCP environments