GRC Program Manager

Redo•Draper, UT

13d•Onsite

About The Position

Redo is an e-commerce growth platform that helps merchants personalize the buyer journey to maximize profit and lifetime value. We are seeking a dedicated owner to take our governance, risk, and compliance (GRC) program to the next level. This role offers a unique opportunity to own GRC end-to-end, drive real impact, and influence the organization. You will deepen and expand compliance across SOC 2, GDPR, CCPA, and future frameworks, setting strategy, owning execution, and shaping how security is integrated into the company. You will also work directly with merchants, leveraging a strong security story to close deals. Partnering closely with engineering, you will translate compliance requirements into concrete controls, ensure audit readiness, and serve as the trusted point of contact for merchant security reviews. We are looking for a seasoned practitioner who can operate independently and be the go-to expert on GRC. This is an opportunity for someone who desires ownership, visible impact, and the chance to shape a maturing security program at a fast-growing company.

Requirements

5+ years in GRC, security compliance, or a closely related role, with hands-on ownership (not just support) of at least one full compliance program.
Demonstrated experience taking a company through a full SOC 2 certification and continued surveillance.
Depth of experience helping SaaS platforms support GDPR and data privacy obligations.
Experience navigating HIPAA and PCI environments.
A self-directed operator who can own and mature a program with minimal oversight — you know what "good" looks like and can drive it independently.
Ability to translate control requirements into engineering requirements and to collaborate credibly with software engineers.
Experience responding to customer security reviews and security questionnaires.
Strong writing and communication skills — you can produce clear policies and explain security posture to both engineers and non-technical stakeholders.
Comfortable in a fast-moving, high-growth environment where you set the pace.
Experience using AI for custom compliance automation

Nice To Haves

Relevant certifications such as CISA, CISSP, ISO 27001 Lead Implementer/Auditor, or CIPP/E.
Experience with GRC automation platforms (e.g., Vanta, Drata, Secureframe).

Responsibilities

Own, mature, and scale Redo's GRC program end to end — SOC 2, GDPR, CCPA, PCI, and HIPAA and additional frameworks as our merchant base demands them.
Partner closely with engineering to translate framework and control requirements into clear, actionable technical and engineering requirements — and make sure they get implemented and stay implemented.
Own audit readiness: lead audits and assessments, manage auditor relationships, and run evidence collection and continuous control monitoring.
Lead compliance sales enablement by responding to merchant and prospect security reviews — questionnaires, due-diligence requests, and trust/security documentation — and turn it into a low friction process that smooths sales deals.
Build and maintain security policies, standards, and procedures, and drive their adoption across the company.
Manage third-party/vendor risk management.
Own our GRC tooling and automation, and drive continuous compliance rather than point-in-time scrambles.
Lead AI enablement of the compliance program — put AI to work automating evidence collection, control monitoring, security-questionnaire responses, and documentation so the program scales faster than headcount.
Manage access reviews, security awareness training, and evidence of ongoing operating effectiveness.
Keep leadership informed on compliance posture, gaps, and progress, and represent Redo's security program to customers and partners.