Staff GRC Specialist

Blitzy•Cambridge, MA

About The Position

Blitzy is a Cambridge, Massachusetts-based AI software development platform company building tools that autonomously execute software development work. The Staff GRC Specialist will join the GRC team and partner with the Head of GRC to run an audit-ready compliance program. The role owns execution of existing SOC 2 Type II and ISO 27001 programs, as well as future programs, and operates Vanta as the system of record. It involves leading day-to-day work with internal stakeholders, auditors, and compliance partners; working with engineering to reduce interruptions from security questions and evidence requests; designing new compliance processes; and helping drive the company's FedRAMP effort. The role also contributes to the strategic governance and compliance vision and supports areas including third-party and vendor risk management, customer trust and sales enablement, and business continuity and disaster recovery governance. The interview process includes a control design and an audit management process walkthrough based on the candidate's experience.

Requirements

10+ years of experience in compliance assurance, controls, and technology risk management.
Bachelor's degree in information systems, computer science, or a related field.
Personal, hands-on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle.
Direct experience running an automated GRC or compliance platform, such as Vanta or an equivalent, as a primary owner.
Track record managing multiple compliance initiatives at once and independently navigating auditor, stakeholder, and vendor relationships, using sound judgment about when to escalate.
Seniority and judgment to reduce stakeholder interruptions rather than add to them.
Clear writing skills for policies, audit narratives, and questionnaire responses that hold up under scrutiny.
Experience mentoring teammates or setting working standards for others.

Nice To Haves

Vendor risk management experience.
Customer trust experience, including security questionnaires and sales enablement.
Prior work at an early-stage or high-growth technology company.
FedRAMP exposure at any level.
Track record building a compliance process from scratch rather than only running an existing playbook.
Experience managing multiple frameworks concurrently.
CISSP, CISA, or CISM certification.

Responsibilities

Lead SOC 2 Type II and ISO 27001:2022 readiness and assurance programs end to end, building toward well-executed audits with low stakeholder impact.
Manage auditor and partner relationships directly and keep management informed about scope and findings.
Own the automated GRC platform as the system of record, including configuring tests, maintaining current evidence, and closing gaps before they become findings.
Design and build compliance processes that do not yet exist.
Critically evaluate evidence rather than accepting it at face value.
Set the standard for security questionnaire and customer compliance responses, handling questions and evidence requests and coaching teammates to do the same.
Contribute to defining strategic governance and compliance vision and plans aligned with Blitzy's business priorities.
Contribute to, support, and eventually drive GRC responsibilities, including third-party and vendor risk management, customer trust and sales enablement, and BC/DR governance.
Help drive the company's FedRAMP effort.