Senior GRC & Compliance Lead for AI Regulation

OpenRouter, Inc; Northern (KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

OpenRouter, Inc is seeking a dedicated compliance leader to own our program day to day, managing Drata and SafeBase integrations, audits, and implementing practical controls across regulatory frameworks.

You will partner with Engineering, HR, Legal, and Security to ensure training, evidence collection, and audit readiness for SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.

Qualifications

• Hands-on experience building and running GRC/compliance programs.
• End-to-end SOC 2 audits experience.
• Ability to converse with engineers about data flows.
• Proactive and cross-functional influencer.

Responsibilities

• Own Drata administration, integrations, and evidence collection.
• Lead SafeBase knowledge base for sales.
• Drive policy acknowledgments, device compliance, and training.
• Run recurring ceremonies: access reviews and tabletop exercises.
• Collaborate with Engineering on product compliance questions.
• Maintain audit readiness across SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and EU AI Act.
• Translate emerging AI regulations into actionable controls.
• Partner with HR, Legal, Finance to align with ongoing work.

Skills

GRC hands-on

SOC 2 knowledge

Compliance automation

Technical with engineers

Cross-functional influence

Education

CISA

CISSP

CIPP

Tools

Drata

SafeBase

Job description

OpenRouter, Inc is seeking a dedicated compliance leader to own our program day to day, managing Drata and SafeBase integrations, audits, and implementing practical controls across regulatory frameworks.

You will partner with Engineering, HR, Legal, and Security to ensure training, evidence collection, and audit readiness for SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.