Remote Information Security & GRC Leader

scribe.com; San Francisco (CA); Hybrid; USD 140.000 - 200.000; Vollzeit

Benefits dieser Stelle

Healthcare Coverage - Comprehensive

Equity - Ownership in what we're build

401(k) Plan - through Vestwell

Flex Benefit - home office/learning/wi

Commuter Benefits - SF based employees

PTO - Flexible paid time off

Parental Leave - Paid leave

Wellness & Family Support - Talkspace

Zusammenfassung

Scribe is scaling its security and compliance program, and the Information Security & GRC Manager will own day-to-day work—SOC 2, customer security reviews, risk management, and internal security operations. You'll turn findings into engineering work and drive remediation with cross‑functional teams.

Based in San Francisco or remote in the US, this role blends hands-on security leadership with policy development, control ownership, and collaboration with Legal, Sales, and Engineering.

Qualifikationen

• 6+ years of experience in information security, GRC, or security compliance at a SaaS or tech company with 2+ years managing ICs
• Hands-on experience running SOC 2 Type II audits
• Experience handling enterprise customer security reviews and questionnaires with Sales/CS/Legal
• Working knowledge of cloud security, IAM, endpoint security, and vulnerability management
• Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe)
• Strong risk judgment and ability to escalate appropriately
• Excellent organization and ability to work with minimal supervision
• Experience with ISO 27001, HIPAA, FERPA, public-sector requirements, and AI governance frameworks
• CISSP, CISM, or CISA preferred

Aufgaben

• Run SOC 2 program end to end with ownership of controls and evidence collection
• Own customer security reviews and security documentation
• Provide legal input on security commitments in contracts and flag non-standard requests
• Maintain risk register, security policies, and vendor security reviews
• Translate audit findings into concrete engineering work and track remediation
• Operate and scale core internal security programs: access reviews, training, endpoint management, vulnerability management, incident readiness

Kenntnisse

SOC 2 Type II

Security reviews

Cloud security

Identity & access management

Vulnerability management

GRC automation (e.g., Vanta, Drata, 0)

Risk management

ISO 27001 / HIPAA / FERPA knowledge

Audit remediation

Cross-functional collaboration

Jobbeschreibung

Scribe is scaling its security and compliance program, and the Information Security & GRC Manager will own day-to-day work—SOC 2, customer security reviews, risk management, and internal security operations. You'll turn findings into engineering work and drive remediation with cross‑functional teams.

Based in San Francisco or remote in the US, this role blends hands-on security leadership with policy development, control ownership, and collaboration with Legal, Sales, and Engineering.