Senior Information Security & GRC Manager (Hybrid, Equity)

Scribe Technology Solutions; San Francisco (CA); Hybrid; USD 180,000 - 240,000; Full time

Benefits offered by this job

Healthcare Coverage

Equity

401(k)

Flex Benefits

Commuter Benefits

PTO

Parental Leave

Wellness & Family Support

Job summary

Scribe is seeking an Information Security & GRC Manager to own day-to-day security and compliance. You’ll run SOC 2 end to end, manage customer security reviews, and drive remediation with Engineering.

You’ll collaborate with Legal, Sales, and Success, shape risk posture, maintain policies, and scale core security programs. 6+ years in security/GRC at SaaS, with hands-on SOC 2 audits and familiarity with ISO 27001, HIPAA, and AI governance, preferred.

Qualifications

• 6+ years in information security, GRC, or security compliance at a SaaS/tech company; 2+ years managing ICs.
• Hands-on experience running SOC 2 Type II audits.
• Experience handling enterprise customer security reviews & questionnaires with Sales/CS/Legal.
• Knowledge of cloud security, IAM, endpoint security, and vulnerability management.
• Familiarity with GRC automation platforms (Vanta, Drata, Secureframe).
• Strong risk judgment to distinguish urgent fixes from long-term work.
• Organizational skills and comfort working with limited supervision.

Responsibilities

• Run our SOC 2 program end to end: ownership, evidence, auditor management, remediation.
• Own customer security reviews; lead security calls with Sales, CS, Legal.
• Provide Legal input on security commitments in MSAs, DPAs, BAAs, and AI terms.
• Maintain risk registers, security policies, and vendor security reviews; propose fixes.
• Translate audit findings into concrete engineering work and track completion.
• Scale internal security programs: access reviews, training, endpoint management, vulnerability management, incident readiness.

Skills

SOC 2 Type II

GRC automation

Enterprise reviews

Cloud security

Identity & access

ISO 27001

Security certifications

Risk governance

Organization and follow-through

Cross-functional collaboration

Education

CISSP/CISM/CISA certifications

Tools

Vanta

Drata

Secureframe

Job description

Scribe is seeking an Information Security & GRC Manager to own day-to-day security and compliance. You’ll run SOC 2 end to end, manage customer security reviews, and drive remediation with Engineering.

You’ll collaborate with Legal, Sales, and Success, shape risk posture, maintain policies, and scale core security programs. 6+ years in security/GRC at SaaS, with hands-on SOC 2 audits and familiarity with ISO 27001, HIPAA, and AI governance, preferred.