GRC Specialist

Fireworks•San Mateo, CA

About The Position

Fireworks is hiring a GRC Specialist to join its security and compliance team and mature its compliance program across frameworks including SOC 2, HIPAA, ISO 27001, ISO 27701, ISO 42001, and GDPR. The role supports audits, risk management, and collaboration with engineering and operations teams to keep controls effective as the company scales. From the start, the specialist will own operational areas such as user access reviews, security awareness through the Adaptive Security platform, and third-party risk management, with opportunities to take on broader audit and program leadership over time. As the role develops, the specialist will move from supporting audits toward leading them end to end, including scoping, auditor coordination, and completion across frameworks. The role will also lead control improvement and automation initiatives, mentor newer team members, represent GRC in cross-functional projects, and help shape the program's direction.

Requirements

5–7 years of experience in GRC, IT audit, information security, or a closely related field.
Working knowledge of major security and privacy frameworks such as SOC 2, ISO 27001/27701/42001, NIST CSF, HIPAA, GDPR, or CCPA.
Experience with GRC platforms such as Anecdotes, Vanta, Drata, Secureframe, OneTrust, or ServiceNow GRC.
Experience running user access reviews and a solid understanding of identity and access management concepts, including RBAC, least privilege, segregation of duties, and JML processes.
Hands-on experience administering a security awareness or phishing simulation platform such as Adaptive Security, KnowBe4, Hoxhunt, Proofpoint, or similar.
Comfort with cloud environments such as AWS, GCP, or Azure, and understanding of how SaaS products are built and operated.
Strong written communication skills, including the ability to explain control requirements and security concepts to engineers, customers, and non-technical employees.
Detail-oriented and organized, with the ability to manage multiple audits, campaigns, and deadlines.
Collaborative mindset and enjoyment of working across teams.

Responsibilities

Own day-to-day GRC operations, including user access reviews and certifications, security awareness and phishing/deepfake simulations, JML tracking, and triage and enforcement of policy and control exceptions.
Run the risk management program by conducting annual and ad-hoc risk assessments, maintaining the risk register, partnering with risk owners on remediation, and tracking issues through closure.
Manage third-party risk assessments for vendors and subprocessors, conduct ongoing monitoring, and track remediation across critical vendors.
Design and execute targeted internal audits to test control effectiveness, and support external audits by coordinating evidence, control owners, and remediation.
Own continuous control monitoring and evidence automation, administer the GRC platform, maintain automated control tests and evidence, and support year-round audit readiness.
Build relationships with partners across engineering, IT, operations, legal, and sales.
Educate control owners on control responsibilities, ownership, and expectations; prepare them for audits and help them operationalize controls.
Review and update security policies, standards, and procedures to keep them practical and aligned with applicable frameworks.
Translate access review, awareness, and risk findings into insights and metrics; report findings to leadership and drive targeted interventions.
Take on additional GRC projects as the program evolves.
Progress toward end-to-end audit leadership, including scoping audits, coordinating auditors, and driving audit cycles to completion across frameworks.
Lead control improvement and automation initiatives as the program scales.
Mentor newer team members, represent GRC in cross-functional projects, and help shape program direction.