GRC Program Manager: Vendor & Privacy Compliance

Clay; San Francisco (CA); On-site; USD 140,000 - 200,000; Full time

Job summary

Clay is seeking a GRC Program Manager to design and own the compliant operations that keep data secure as we scale. You’ll work across engineering, security, legal, and product teams to implement vendor onboarding, data privacy, and security review processes that scale with our growth.

You’ll build end-to-end programs for onboarding vendors, manage subprocessor lists, respond to privacy questionnaires, and drive cross-functional initiatives with strong project management and clear communication.

Qualifications

• Bachelor's degree in Information Security, Business, or a related field (or equivalent experience).
• 5+ years of experience building and scaling operational programs in a SaaS or tech environment.
• Strong builder mindset with ability to create processes from scratch.
• Understanding of privacy laws and frameworks (GDPR, CCPA/CPRA) with practical application across vendor management and data flows.
• Experience with vendor risk assessments, security questionnaires, and DPA/subprocessor management.
• Familiarity with DSAR processes and tools like Vanta, Transcend, or similar platforms.
• Excellent project management skills and ability to drive cross-functional initiatives to completion.
• Strong communication skills for partnering with legal, engineering, data teams, and business stakeholders.
• Ability to work independently in a fast-paced, high-growth environment.

Responsibilities

• Vendor Onboarding & Risk Management: build and own end-to-end vendor onboarding compliance, including reviews (DPA, SOC 2/GDPR), updating subprocessor lists, and customer notifications.
• GRC Vendor Management: act as internal owner for external GRC vendors, manage intake, SLAs, quality reviews, and performance metrics.
• Compliance Reviews: develop and run compliance reviews when evaluating new data sets and vendor compliance.
• Cross-Functional Program Building: create scalable operational processes and systems to grow compliance work across the company.
• Customer Security Support: assist in responding to security and privacy questionnaires from customers.

Job description

Clay is seeking a GRC Program Manager to design and own the compliant operations that keep data secure as we scale. You’ll work across engineering, security, legal, and product teams to implement vendor onboarding, data privacy, and security review processes that scale with our growth.

You’ll build end-to-end programs for onboarding vendors, manage subprocessor lists, respond to privacy questionnaires, and drive cross-functional initiatives with strong project management and clear communication.