Senior GRC Program Lead - SOC 2, GDPR & Security

Tandem Inc.; Draper (UT); Hybrid; USD 110,000 - 170,000; Full time

Benefits offered by this job

On-site gym

Flexible PTO

Redo perks: monthly ecommerce credit

Company HSA contributions

Weekly team lunches

Job summary

Redo is seeking a Senior GRC Program Manager to own and scale governance, risk, and compliance across SOC 2, GDPR, CCPA, PCI, and HIPAA. You will translate framework requirements with engineering, lead audits, and partner with sales on security reviews to close deals.

You will build and enforce security policies, manage vendor risk, and drive continuous compliance with AI-enabled automation, all while advocating for security at a rapidly growing ecommerce platform.

Qualifications

• 5+ years in GRC, security compliance, or related role with hands-on ownership of a full program.
• Experience leading a SOC 2 certification and ongoing surveillance.
• Depth in GDPR/data privacy obligations for SaaS platforms.
• Experience in HIPAA and PCI environments.
• Able to translate control requirements into engineering actions and collaborate with software engineers.
• Experience responding to customer security reviews and security questionnaires.
• Strong writing and communication skills for policies and security posture explanations.
• Experience using AI for automating compliance activities.

Responsibilities

• Own, mature, and scale the GRC program end to end (SOC 2, GDPR, CCPA, PCI, HIPAA).
• Translate framework and control requirements into actionable engineering requirements.
• Lead audits, manage auditor relationships, and collect evidence.
• Support security reviews and questionnaires to accelerate sales deals.
• Develop and maintain security policies, standards, and procedures across the company.
• Oversee third-party/vendor risk management and GRC tooling.
• Drive AI-enabled automation for evidence collection and monitoring.

Skills

GRC ownership

SOC 2 experience

GDPR/data privacy

HIPAA/PCI experience

engineering collaboration

security questionnaires

AI for compliance

writing/communication

Tools

Vanta

Drata

Secureframe

Job description

Redo is seeking a Senior GRC Program Manager to own and scale governance, risk, and compliance across SOC 2, GDPR, CCPA, PCI, and HIPAA. You will translate framework requirements with engineering, lead audits, and partner with sales on security reviews to close deals.

You will build and enforce security policies, manage vendor risk, and drive continuous compliance with AI-enabled automation, all while advocating for security at a rapidly growing ecommerce platform.