Remote Risk & Controls Lead (ISO27001/SOC2)

Consensys (MetaMask); United States; À distance; USD 150 000 - 206 000; Plein temps

Résumé du poste

MetaMask is seeking a senior risk and GRC specialist to own the internal posture engine, maintaining the risk register, evidence, and audit operations. You will coordinate ISO 27001 and SOC 2 activities, and ensure data-driven risk reporting for the Risk Committee.

This remote-first, global role requires hands-on experience with Drata or similar platforms, strong stakeholder management, and clear written work to keep control owners accountable.

Qualifications

• Hands-on experience running a risk register, control library and audit cycle (ISO 27001 and/or SOC 2).
• Comfortable with GRC platforms (Drata or equivalent) and turning monitoring into evidence.
• Proven ability to coordinate audits and customer questionnaires with named control owners.
• Precise written work; register and Statement of Applicability quality matters.
• Strong stakeholder management with control owners and auditors.

Responsabilités

• Operate the risk register from the Security Programme threat model: populate, track treatment, record acceptance decisions, follow up owners, and run the exceptions register.
• Keep the ISMS and security policy library current as part of audit readiness. Draft security standards when commissioned by the Lead.
• Run Drata as the control and evidence system — Statement of Applicability, framework crosswalk and automation.

Connaissances

Risk Register

GRC Platforms

Audit Coordination

Stakeholder Management

Written Communication

Formation

CISA

ISO 27001 Lead Implementer/Auditor

Outils

Drata

Description du poste

MetaMask is seeking a senior risk and GRC specialist to own the internal posture engine, maintaining the risk register, evidence, and audit operations. You will coordinate ISO 27001 and SOC 2 activities, and ensure data-driven risk reporting for the Risk Committee.

This remote-first, global role requires hands-on experience with Drata or similar platforms, strong stakeholder management, and clear written work to keep control owners accountable.