Senior Security GRC Lead: SOC 2 & PCI DSS

Turo; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Equity

In-office lunch

Office snacks

Paid time off

Paid holidays

Volunteer time off

Parental leave

Job summary

Turo is seeking a Senior Security GRC Analyst to own SOC 2 Type II and PCI DSS audit readiness and drive cross-functional security compliance efforts. You will coordinate evidence with Engineering, IT, Finance, Legal, and business owners, manage findings and remediation, and maintain the control framework for ongoing audit readiness.

Ideal candidates bring 5+ years in security compliance, GRC, or IT audit, with hands-on SOC 2/PCI DSS experience, and familiarity with AWS/IAM and encryption

Qualifications

• 5+ years in security compliance, GRC, or IT audit.
• Direct ownership of at least one full audit cycle under SOC 2 Type II and/or PCI DSS.
• Coordinating evidence collection across multiple teams with limited oversight.
• Knowledge of cloud security (AWS), IAM, and encryption frameworks.

Responsibilities

• Own the compliance calendar and drive audit readiness for SOC 2 Type II and PCI DSS.
• Coordinate evidence collection across Engineering, IT, Finance, and business teams.
• Serve as primary liaison with external auditors and assessors.
• Maintain and evolve the control framework across SOC 2 and PCI DSS.
• Lead testing, document results, and manage evidence repositories.

Skills

Security compliance

GRC

IT audit

AWS

IAM

Encryption

Policy writing

Interpersonal communication

Education

Bachelor's degree in Computer Science, Information Security, Information Assurance or equivalent practical experience

CISA

CISM

CISSP

Tools

Vanta

Drata

ZenGRC

Job description

Turo is seeking a Senior Security GRC Analyst to own SOC 2 Type II and PCI DSS audit readiness and drive cross-functional security compliance efforts. You will coordinate evidence with Engineering, IT, Finance, Legal, and business owners, manage findings and remediation, and maintain the control framework for ongoing audit readiness.

Ideal candidates bring 5+ years in security compliance, GRC, or IT audit, with hands-on SOC 2/PCI DSS experience, and familiarity with AWS/IAM and encryption