Strategic GRC Leader - Remote + Equity

OpenRouter, Inc; United States; Remote; USD 175,000 - 205,000; Full time

Job summary

OpenRouter, Inc. is seeking a GRC Manager to own the compliance program day to day in a fully remote US role. You’ll shepherd SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act, collaborating with IT, Security, Legal, and Finance to embed controls across the company.

Reporting to the Head of IT & Security, you’ll drive audits, evidence collection, training, and policy updates, while shaping a pragmatic approach that scales with a fast-growing, remote-first environment.

Qualifications

• Hands-on GRC/compliance program experience.
• At least one SOC 2 audit cycle owned end to end.
• Fluent in compliance automation (Drata preferred).
• Able to discuss architecture and data flows with engineers.
• Strong cross-functional influence and adaptability.

Responsibilities

• Own Drata end-to-end — administration, integrations, monitoring test health, and the manual evidence collection automation doesn't reach.
• Curate the SafeBase knowledge base so sales can self-serve most customer security questionnaires — and be the escalation point for the ones they can't.
• Drive personnel compliance: policy acknowledgments, device compliance, and recurring security and compliance training. This means chasing people down and building the habit, not just running the report.
• Lead recurring ceremonies: user access reviews, penetration tests, BCDR and incident response tabletop exercises, annual policy review and updates, risk assessments.
• Work directly with Engineering on product-related compliance questions, from data handling to customer commitments.
• Maintain audit readiness across SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.
• Translate emerging AI regulation into controls we can actually operate, rather than waiting for someone else's checklist.
• Partner with HR, Legal, Customer Support, and Finance so compliance fits into work that's already happening.

Skills

GRC

Compliance

SOC 2

Drata

Cross-functional influence

Engineering collaboration

Audit management

Regulatory knowledge

Education

Bachelor's degree

Tools

Drata

SafeBase

Job description

OpenRouter, Inc. is seeking a GRC Manager to own the compliance program day to day in a fully remote US role. You’ll shepherd SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act, collaborating with IT, Security, Legal, and Finance to embed controls across the company.

Reporting to the Head of IT & Security, you’ll drive audits, evidence collection, training, and policy updates, while shaping a pragmatic approach that scales with a fast-growing, remote-first environment.