Senior GRC Lead - AI Security & Compliance

Replit; California (MO); On-site; USD 180,000 - 240,000; Full time

Benefits offered by this job

401(k) match

Health insurance

Dental insurance

Vision insurance

Life insurance

Disability coverage

Parental leave

Flexible PTO

Commuter benefits

Wellness stipend

In-office reimbursement

Team gatherings

Job summary

Replit is building a security GRC function to scale with an AI-native product. As Risk & Compliance lead, you will own certification programs (SOC 2, ISO 27001) end-to-end, manage risk registers, and oversee continuous compliance.

You’ll partner with Engineering and Legal to ensure controls are practical and auditable. You will drive audit readiness, control documentation like ISMS/SSPs, and collaborate with the GRC Engineer to automate evidence where possible, while aligning with GDPR

Qualifications

• 8+ years in security compliance, IT audit, or GRC roles with direct ownership of at least one SOC 2 and/or ISO 27001
• Familiarity with SOC 2, ISO 27001, NIST CSF and mapping controls
• Experience authoring or maintaining ISMS/SSP documents
• Experience with risk registers and remediation reporting
• Experience with GRC automation platforms and continuous control monitoring
• Experience working with external auditors end-to-end
• Ability to read technical control evidence and discuss systems with engineers
• Familiarity with GDPR/privacy fundamentals to assist legal teams

Responsibilities

• Own end-to-end certification roadmap (SOC 2 Type II, ISO 27001) including scoping, gaps, remediation, audits
• Manage relationships with external auditors and audit calendars
• Own master security risk register with risk scoring and treatments
• Build continuous compliance monitoring reflecting real-time control status
• Maintain audit artifacts (ISMS, SSPs, control evidence)
• Run audits, readiness assessments, and track remediation to closure
• Support GDPR/privacy compliance with Legal/Privacy teams
• Collaborate with GRC Engineer on evidence collection and automation
• Report compliance posture and audit findings to security leadership

Skills

8+ years in security compliance

SOC 2 / ISO 27001 ownership

GRC automation

ISMS / SSP documentation

Auditing with external auditors

Privacy familiarity (GDPR)

Tools

Anecdotes

Vanta

Drata

Job description

Replit is building a security GRC function to scale with an AI-native product. As Risk & Compliance lead, you will own certification programs (SOC 2, ISO 27001) end-to-end, manage risk registers, and oversee continuous compliance.

You’ll partner with Engineering and Legal to ensure controls are practical and auditable. You will drive audit readiness, control documentation like ISMS/SSPs, and collaborate with the GRC Engineer to automate evidence where possible, while aligning with GDPR