Senior Risk & Controls Manager (ISO27001/SOC2)

HireHi; United States; Remote; USD 150,000 - 206,000; Full time

Job summary

MetaMask is seeking a Security & GRC lead to own the risk register, drive ISO 27001 and SOC 2 initiatives, and maintain audit evidence. You will draft standards, coordinate audits with control owners, and ensure continuous Drata integration for posture validation.

The role requires precise writing, strong stakeholder coordination, and experience with governance, risk, and compliance platforms. Remote-friendly with US focus.

Qualifications

• Experience running a risk register and audit cycle (ISO 27001 and/or SOC 2).
• Coordinate audits and customer questionnaires with control owners.
• Precise written work and documentation.
• Knowledge of ISMS and security policy libraries.
• Certification in CISA or ISO 27001 preferred.

Responsibilities

• Operate the risk register based on the Security Programme threat model and track treatment.
• Draft security standards using Drata for evidence and SOA, including framework crosswalk and automation.
• Coordinate audits, evidence, and status updates with owners and auditors.
• Lead ISO 27001 and SOC 2 audit logistics, readiness, and management-review packs.
• Coordinate external testing including red team, tabletop exercises, and pentests.
• Run security awareness programs and track residual risk and gaps.

Skills

Risk management

Audit coordination

ISO 27001

SOC 2

GRC platforms

Drata

Stakeholder management

Education

CISA

ISO 27001 Lead Implementer/Auditor

Tools

Drata

Audit management software

Job description

MetaMask is seeking a Security & GRC lead to own the risk register, drive ISO 27001 and SOC 2 initiatives, and maintain audit evidence. You will draft standards, coordinate audits with control owners, and ensure continuous Drata integration for posture validation.

The role requires precise writing, strong stakeholder coordination, and experience with governance, risk, and compliance platforms. Remote-friendly with US focus.