Remote GRC & Risk Controls Lead (ISO 27001/SOC 2)

MetaMask; United States; Remote; USD 150,000 - 206,000; Full time

Job summary

MetaMask in the United States is seeking a results-driven risk and compliance professional to run our internal posture engine, maintain the risk register, evidence, and audit operations. You will ensure ISO 27001 and SOC 2 readiness, coordinate audits, and keep documentation accurate for leadership and customers.

The role requires hands-on experience with risk registers, GRC platforms (Drata or equivalent), stakeholder management, and precise reporting.

Qualifications

• Hands-on experience running a risk register, control library and audit cycle (ISO 27001 and/or SOC 2).
• Comfortable with GRC platforms (Drata or equivalent) and turning monitoring into evidence.
• Proven ability to coordinate audits and customer questionnaires with named control owners.
• Precise written work; register and Statement of Applicability quality matters.
• Strong stakeholder management with control owners and auditors.
• CISA, ISO 27001 Lead Implementer or Auditor, or equivalent professional certification.

Responsibilities

• Operate the risk register: populate, track treatment, record decisions, follow up owners.
• Maintain ISMS and security policy library for audit readiness and draft standards when asked.
• Run Drata as control/evidence system: SoA, framework crosswalk, and automation.
• Monitor critical controls: health checks, drift flags, and route drift to SOC; keep evidence.
• Feed threat findings into the register and track current assessments.
• Coordinate ISO 27001/SOC 2 audits: logistics, readiness, and questionnaires.
• Coordinate control register for tests: red team, tabletop, pentest; run awareness and alerts.
• Report residual risk and gaps; keep management view one source of truth.
• Be accountable for posture engine: register, evidence, and audit ops.
• Ensure continuous evidence collection in Drata where coverage exists.

Skills

Risk management

Audit coordination

Documentation quality

Stakeholder management

Regulatory knowledge

Education

CISA, ISO 27001 Lead Implementer or Auditor, or equivalent

Tools

Drata

Job description

MetaMask in the United States is seeking a results-driven risk and compliance professional to run our internal posture engine, maintain the risk register, evidence, and audit operations. You will ensure ISO 27001 and SOC 2 readiness, coordinate audits, and keep documentation accurate for leadership and customers.

The role requires hands-on experience with risk registers, GRC platforms (Drata or equivalent), stakeholder management, and precise reporting.