Staff Security GRC Lead — SOC 2/NIST

Suno; New York (NY); On-site; USD 150,000 - 210,000; Full time

Job summary

Suno is building the world's first creative entertainment platform. We are hiring a Staff Security GRC Analyst to establish Suno's security compliance program from scratch and own the control framework, mapping to SOC 2 and NIST CSF while collaborating with AppSec and InfraSec leadership to align with business goals.

You will automate evidence collection, drive SOC 2 readiness end-to-end, manage vendor reviews, and help scale GRC as a core security function reporting to the CISO.

Qualifications

• 7–9 years in GRC, security compliance, or IT audit.
• End-to-end ownership of a security compliance program.
• Deep knowledge of SOC 2 and NIST CSF, including mapping and audits.
• Ability to read cloud configurations and assess enforcement.
• Comfort building automation with scripts or AI tools.
• Experience with continuous controls monitoring or automated evidence collection.

Responsibilities

• Build and own Suno's security control framework, mapping controls to SOC 2, NIST CSF, and future frameworks.
• Lead SOC 2 preparation end to end, including gap assessments and remediation with owners and auditor.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools.
• Run vendor security reviews, keep security policies current, and answer customer security questionnaires.
• Partner with the CISO to give leadership and board a clear, evidence-backed view of our security posture.
• Help earn the trust of partners and customers to broaden Suno's reach.

Skills

GRC leadership

SOC 2 experience

NIST CSF knowledge

Cloud familiarity

Automation skills

Tools

AWS

GCP

GRC platform

Job description

Suno is building the world's first creative entertainment platform. We are hiring a Staff Security GRC Analyst to establish Suno's security compliance program from scratch and own the control framework, mapping to SOC 2 and NIST CSF while collaborating with AppSec and InfraSec leadership to align with business goals.

You will automate evidence collection, drive SOC 2 readiness end-to-end, manage vendor reviews, and help scale GRC as a core security function reporting to the CISO.