Staff GRC Specialist

Blitzy•Cambridge, MA

3d•$160,000 - $240,000

About The Position

Blitzy is hiring a Staff GRC Specialist to help operate and develop its governance, risk, and compliance program. Reporting to and partnering with the Head of GRC, this role will own execution of the company’s existing SOC 2 Type II and ISO 27001 programs, as well as future programs, and help drive the FedRAMP effort. The specialist will operate Vanta or an equivalent automated GRC platform as the system of record and lead day-to-day coordination with internal stakeholders, auditors, and compliance partners. The role focuses on maintaining audit readiness, managing evidence and control gaps, and designing compliance processes that do not yet exist. The specialist will work closely with engineering and other teams to reduce interruptions caused by security questions and evidence requests, while setting standards and coaching teammates on customer compliance responses. The position also contributes to governance strategy, vendor risk, customer trust and sales enablement, and business continuity and disaster recovery governance.

Requirements

10+ years of experience in compliance assurance, controls, and technology risk management.
Bachelor’s degree in information systems, computer science, or a related field.
Hands-on ownership of at least one complete SOC 2 Type II or ISO 27001:2022 audit cycle.
Direct experience as the primary owner of an automated GRC or compliance platform, such as Vanta or an equivalent.
Track record of managing multiple compliance initiatives concurrently and independently navigating auditor, stakeholder, and vendor relationships, with sound judgment about when to escalate.
Ability to reduce stakeholder interruptions rather than add to them.
Clear writing skills for policies, audit narratives, and questionnaire responses that withstand scrutiny.
Experience mentoring teammates or establishing working standards for others.

Nice To Haves

Vendor risk management experience.
Customer trust experience, including security questionnaires and sales enablement.
Prior experience at an early-stage or high-growth technology company.
FedRAMP exposure at any level.
Experience building a compliance process from scratch rather than only operating an existing playbook.
Experience managing multiple frameworks concurrently.
CISSP, CISA, or CISM certification.

Responsibilities

Lead SOC 2 Type II and ISO 27001:2022 readiness and assurance programs end to end, building toward well-executed audits with low stakeholder impact.
Manage auditor and partner relationships directly and keep management informed about scope and findings.
Own and operate the automated GRC platform as the system of record, including configuring tests, maintaining current evidence, and closing gaps before they become findings.
Design and build compliance processes that do not yet exist.
Evaluate evidence critically rather than accepting it at face value.
Set standards for security questionnaires and customer compliance responses, handle questions and evidence requests, and coach teammates to do the same.
Contribute to defining governance and compliance strategy and plans aligned with Blitzy’s business priorities.
Contribute to and support third-party and vendor risk management, customer trust and sales enablement, and business continuity and disaster recovery governance; eventually drive some of these responsibilities.
Help drive the company’s FedRAMP effort.