InfoSec & GRC Manager — SOC 2 & Risk Lead

Scribe; San Francisco (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Healthcare Coverage

Equity

401(k) Plan

Flex Benefit

Commuter Benefits

PTO

Parental Leave

Wellness & Family Support

Job summary

Scribe is seeking an Information Security & GRC Manager to own day‑to‑day security and compliance efforts. The role covers SOC 2, risk management, vendor security reviews, and security documentation in collaboration with Legal, Sales, and Customer Success.

You’ll lead remediation efforts with Engineering, maintain internal controls, and scale security programs across the company as we grow. Hybrid, SF‑based with office presence required.

Qualifications

• 6+ years of information security, GRC, or security compliance at a SaaS/tech company.
• Hands‑on experience running SOC 2 Type II audits.
• Experience handling enterprise customer security reviews and questionnaires with Sales, CS, and Legal.
• Knowledge of cloud security, IAM, endpoint security, and vulnerability management.
• Familiarity with GRC automation platforms (Vanta, Drata, Secureframe).
• Sound risk judgment and ability to prioritize work.

Responsibilities

• Run SOC 2 program end to end with ownership of evidence, auditors, gaps, and broader frameworks.
• Own customer security reviews and security documentation; lead security calls with cross‑functional teams.
• Provide Legal input on security commitments in MSAs, DPAs, BAAs, and AI terms.
• Maintain risk register, security policies, and vendor review process; advise leadership on fixes.
• Translate audit findings and control requirements into concrete engineering work and track to completion.
• Scale core internal security programs: access reviews, security awareness, endpoint mgmt, vulnerability mgmt, incident readiness.

Skills

SOC 2 Management

GRC

Security Reviews

Risk Management

Vendor Security

Audits

ISO 27001

HIPAA

CISSP/CISM/CISA

Tools

Vanta

Drata

Secureframe

Job description

Scribe is seeking an Information Security & GRC Manager to own day‑to‑day security and compliance efforts. The role covers SOC 2, risk management, vendor security reviews, and security documentation in collaboration with Legal, Sales, and Customer Success.

You’ll lead remediation efforts with Engineering, maintain internal controls, and scale security programs across the company as we grow. Hybrid, SF‑based with office presence required.