GRC & Security Lead — SOC 2 & Enterprise Trust

Somana; New York (NY); On-site; USD 140,000 - 210,000; Full time

Benefits offered by this job

Equity

Lunch provided

Pet-friendly office

Health benefits (HSA)

Job summary

Somana, a generative robotics company in SoHo, NYC, seeks a Security & Compliance Manager (GRC) to own the SOC 2 program end to end, manage customer security reviews, and drive risk remediation with engineering and operations.

You will scale the program as the company grows, maintaining evidence, controls, and a health-focused compliance platform for enterprise customers and auditors.

Qualifications

• 3+ years in GRC or security compliance.
• Led a SOC 2 audit end to end.
• Hands-on experience running a compliance platform (Vanta, Drata, Oneleet or similar).
• Ability to read system architecture and talk credibly with engineers.
• Comfortable owning a program with minimal scaffolding at an early-stage company.

Responsibilities

• Run the SOC 2 program end to end: auditor relationship, compliance platform, evidence collection, policy lifecycle, and security awareness training
• Own customer security questionnaires and security reviews - turn them around fast enough to keep deals moving, and use them as a signal for what to fix internally
• Run quarterly access reviews and own third-party risk for vendors and contractors
• Partner with engineering to make realistic controls - from read architecture, verifiable control implementation, and drive remediation when needed
• Maintain the risk register and track findings to closure across audit cycles
• Represent Somana in customer audits and formal assessments, clearly explaining security posture, governance decisions, and risk management approaches.
• Maintain the compliance platform health (continuous monitoring, automated evidence)

Skills

GRC leadership

SOC 2 end-to-end

Security program mgmt

Technical storytelling

Tools

Vanta

Drata

Oneleet

Job description

Somana, a generative robotics company in SoHo, NYC, seeks a Security & Compliance Manager (GRC) to own the SOC 2 program end to end, manage customer security reviews, and drive risk remediation with engineering and operations.

You will scale the program as the company grows, maintaining evidence, controls, and a health-focused compliance platform for enterprise customers and auditors.