Director - Governance, Risk, Compliance & Privacy (GRC)

Beacon Holdings • San Francisco, CA

8h

About The Position

Beacon Software is building a portfolio of vertical SaaS companies and seeks a GRC leader to establish and scale governance, risk, compliance, and privacy across Beacon and its portfolio. This is a founding, high-ownership role for a builder who favors automation and modern AI tools.

The role covers Beacon’s enterprise governance program—including security policy, AI and data governance, privacy, enterprise and third-party risk, and posture reporting—as well as hands-on support for portfolio companies’ audits and certifications. These may include SOC 2, ISO 27001, accessibility conformance, and other standards required by customers. The position will create a scalable, common control architecture that maps controls across standards, uses AI-first automation, and provides clear program reporting. The function is at an early stage and is intended to grow with the business rather than focus on a single audit.

Requirements

• Have built or substantially matured a GRC program and taken an organization through SOC 2 Type 2.
• Typically have 5 or more years of experience in GRC, IT governance, or security compliance; demonstrated accomplishments matter more than years alone.
• Have a builder’s bias for action and look to automate manual processes.
• Be able to design scalable GRC architectures rather than one-off audit fixes.
• Be fluent with a compliance automation platform such as Vanta, Drata, Secureframe, or similar.
• Be current on practical AI tooling.
• Be comfortable with both security compliance and data privacy, or able to ramp quickly on unfamiliar regimes.
• Be an excellent cross-functional communicator who can work through influence and make requirements actionable for technical and non-technical teams.
• Be a clear writer.
• Have worked in a fast-paced startup environment.

Nice To Haves

• Privacy or audit certifications such as CIPP, CIPM, CISA, CISSP, or ISO 27001 Lead Auditor or Implementer.
• Experience with standards or regimes beyond SOC 2, including ISO 27001, PCI DSS, HIPAA, FedRAMP, or StateRAMP.
• Experience with accessibility conformance, including WCAG or VPAT.
• Technical fluency to scope program needs and partner closely with engineering, even without building the tooling.
• Multi-entity, private-equity, or holding-company experience.
• M&A security and privacy diligence experience.

Responsibilities

• Build and scale the GRC function across Beacon and its portfolio companies.
• Develop Beacon’s enterprise governance program, including security policy, AI governance, data governance and privacy, enterprise and third-party risk, and posture reporting.
• Work directly with portfolio companies to support and take them through audits and certifications, including SOC 2, ISO 27001, and accessibility conformance.
• Design a repeatable service model for portfolio-company compliance work that scales across the portfolio.
• Create a common control architecture that maps controls across multiple standards.
• Use automation platforms and AI-assisted workflows to reduce manual GRC processes.
• Provide clear program reporting.
• Translate compliance requirements into actionable terms for technical and non-technical teams and work cross-functionally through influence.

What This Job Offers

• Job Type: Full-time
• Career Level: Director
• Education Level: No Education Listed