InfoSec & GRC Manager: SOC 2 & Risk Lead

Scribe; United States; Hybrid; USD 144,000 - 220,000; Full time

Benefits offered by this job

Healthcare Coverage

Equity

401(k) Plan

Flex Benefit

Commuter Benefits

PTO

Parental Leave

Wellness & Family Support

Job summary

Scribe is seeking an Information Security & GRC Manager in San Francisco to own day-to-day security and compliance. You will run SOC 2 end to end, manage customer security reviews, and drive remediation with Engineering.

You will maintain risk registers, security policies, and vendor reviews, while translating audit findings into actionable engineering work and guiding incident readiness and security awareness initiatives.

Qualifications

• 6+ years in information security, GRC, or security compliance at a SaaS/tech company.

Responsibilities

• Run SOC 2 program end to end, including control ownership, evidence collection, auditor management and remediation.
• Own customer security reviews and security documentation with Sales, Customer Success and Legal.
• Provide Legal input on security commitments in customer contracts and flag non-standard requests.
• Maintain the risk register, security policies, and vendor security review process; escalate risks with clear recommendations.
• Translate audit findings and security requirements into concrete engineering work and track to completion.
• Operate and scale core internal security programs: access reviews, security awareness, endpoint management, vulnerability management, and incident response readiness.

Skills

SOC2

GRC

Security reviews

Risk management

Cloud security

IAM

Vulnerability management

GRC automation

Education

CISSP

CISM

CISA

ISO 27001

HIPAA

Tools

Vanta

Drata

Secureframe

Job description

Scribe is seeking an Information Security & GRC Manager in San Francisco to own day-to-day security and compliance. You will run SOC 2 end to end, manage customer security reviews, and drive remediation with Engineering.

You will maintain risk registers, security policies, and vendor reviews, while translating audit findings into actionable engineering work and guiding incident readiness and security awareness initiatives.