Remote GRC Lead — AI Security & Compliance

Applied Methods Ltd; Foster City (CA); On-site; USD 210,000 - 270,000; Full time

Benefits offered by this job

Competitive Salary

401(k) with 4% match

Health, Dental, Vision, Life

Paid parental leave

Flexible Time Off

Commuter benefits

In-office setup reimbursement

Team gatherings

Job summary

Replit is building a security GRC function to scale with an AI-native product. As Risk & Compliance Lead, you will own the certification program end to end and manage the master security risk register with remediation plans.

You will collaborate with Engineering and Legal/Privacy to ensure controls are practical and compliant. You will partner with the GRC Engineer to define automated evidence collection and monitor controls across SOC 2, ISO 27001, and future frameworks.

Qualifications

• 8+ years in security compliance, IT audit, or GRC roles with direct ownership of at least one SOC 2 and/or ISO 27001 cycle.
• Hands-on experience authoring or maintaining ISMS/SSPs and audit-facing docs.
• Experience owning a formal risk register and reporting to leadership on risk.

Responsibilities

• Own end-to-end certification roadmaps (SOC 2 Type II, ISO 27001) and future AI governance frames.
• Manage external auditors and annual audit calendars for timely renewals.
• Maintain the master security risk register with risk scoring and treatment plans.
• Build continuous compliance monitoring reflecting real-time control status.
• Own ISMS documentation, Statements of Applicability, risk assessments.
• Run audits/readiness assessments and track remediation to closure.
• Support GDPR and privacy compliance with Legal/Privacy teams.

Skills

Security compliance

GRC

SOC 2

ISO 27001

Audit management

Risk register

NIST CSF

Automation in GRC

Tools

Anecdotes

Vanta

Drata

Job description

Replit is building a security GRC function to scale with an AI-native product. As Risk & Compliance Lead, you will own the certification program end to end and manage the master security risk register with remediation plans.

You will collaborate with Engineering and Legal/Privacy to ensure controls are practical and compliant. You will partner with the GRC Engineer to define automated evidence collection and monitor controls across SOC 2, ISO 27001, and future frameworks.