Security GRC Lead

Role Description

You'll be the first GRC hire at a company that processes some of the most sensitive data on earth: training data, evals, and human-feedback pipelines for the frontier AI labs, plus payments and KYC for 300K+ experts.

This is not an audit-theater role. You'll own the operating cadence of a continuously-audited company: continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA. You'll write controls in code where it makes sense, push back on tools that fight you, and own the artifacts that close enterprise deals.

We use AI heavily in our own GRC work. You should be comfortable using LLMs to draft, review, and respond at speed. If you've ever copy-pasted the same answer into 14 vendor questionnaires by hand, you'll appreciate not having to.

We're in-person five days a week at our SF headquarters, with first Fridays remote.

What You'll Build

• The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act conformity - your call on sequencing)

• A customer-audit machine that responds tocustomers

• The third-party risk program - formal intake, recurring review cadence, evidence requirements - tied into procurement so vendors can't be onboarded around it

• Policy lifecycle owned end-to-end: version, attestation, exception handling, review cycle - not a SharePoint graveyard

• Controls-as-code where it makes sense: integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection

• Data-handling procedures: the customer-data-deletion gap, DSAR workflow, KMS scheduled destruction, offboarding handlers

• The internal trust narrative: customer trust pages, security one-pagers, executive-ready disclosure templates when something goes sideways

What We're Looking For

• 7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under audit by enterprise customers

• You've shipped at least one ISO 27001 certification from kickoff to issued certificate, including Stage 1 and Stage 2 with a real registrar

• Fluent in Vanta (or Drata, Secureframe, Sprinto) at the integration and admin level, not just the reviewer UI - you've configured connectors, written custom tests, debugged broken evidence

• You translate cloud-security language to auditor language and back without losing precision - you can read a Wiz finding, a Panther rule, an IAM policy, and say what control it maps to

• You write controls as code or query evidence with SQL when the platform falls short - Python, SQL, or shell, whatever it takes

• You know the difference between "we don't have a control for that" and "we have a compensating control" and you don't fabricate the second one

• Direct experience with the customer-trust surface: SIG, CAIQ, custom enterprise questionnaires, on-site auditor sessions, disclosure letters under legal review

Bonus Points

• Built or operated a GRC program inside an AI lab, ML platform, or company serving frontier labs as customers

• Familiar with AI-specific frameworks: NIST AI RMF, EU AI Act conformity, ISO 42001

• Experience with FedRAMP Moderate, HIPAA, PCI DSS, or SOC 2 + HITRUST dual scope

• You've automated questionnaire response with an LLM and know where it works and where it fails

• Prior experience standing up a third-party risk program from zero - vendor intake, recurring review, contract teeth

• Written a public trust page that customers actually trust

Benefits

• Bi-annual performance bonus structure

• Generous equity grant vested over 4 years

• Up to $15k Relocation bonus

• $10K housing bonus (if you live within 0.5 miles of our office)

• $1.5K monthly stipend for meals

• Free Equinox membership

• $200 monthly laundry reimbursement

• $200 monthly personal wellness reimbursement

• Health, Dental, Vision insurance