Summary
What you’ll impact
Our company is seeking a Security Assurance & GRC Lead to own and advance the customer assurance and compliance programs, shaping the GRC roadmap across SOC 2, ISO 27001, privacy, and enterprise requirements. The role involves leading security conversations with customers, coordinating cross‑functional efforts, and turning security reviews into product improvements to make security a competitive advantage.
Responsibilities
What you'll do
- Own the GRC roadmap. Define priorities across SOC 2 Type II, ISO 27001, customer requirements, privacy, and risk management. Enterprise blockers come first, with everything else sequenced by business impact.
- Lead customer assurance end-to-end. Represent Wispr Flow on calls, in security reviews, and in written responses. Own questionnaires, due-diligence requests, vendor assessments, and RFP security sections through completion, and drive cross-functional resolution on escalations. Never make claims the evidence doesn't support.
- Get ahead of strategic deals. Engage early on major opportunities, anticipate objections, and build a security plan with Sales.
- Make security a GTM advantage. Improve the Trust Center, standard responses, and security narratives so customers can self-serve and our posture is easy to understand.
- Build the system, not just run it. Track turnaround times, recurring objections, and repetitive work, then standardize and automate. Keep Drata, SafeBase, and Linear accurate.
- Develop the team. Partner with our compliance engineer to build the operating processes together, strengthening process design, prioritization, and follow-through while drawing on their technical and compliance expertise.
- Feed reviews back into the product. Turn patterns from security reviews into structured input for Product and Engineering on SSO/SCIM, audit logs, permissions, retention, data residency, and AI/data handling.
- Own the AI security narrative. Customers will ask about model providers, training and data usage, retention, subprocessors, and how their data moves through our system. Answer those questions and keep the answers current as the product changes. When incidents happen, coordinate clear, accurate customer-facing communication (you won't own incident response itself).
- Keep compliance running. Coordinate audit evidence, track deadlines, maintain controls and policies, drive remediation, and keep the risk register, vendor inventory, and compliance calendar current.
Requirements
What you’ll bring
- Depth in GRC, security compliance, customer assurance, IT audit, or risk management, with enough range to own both the program and the customer conversation.
- Experience leading customer security reviews and explaining security to technical and non-technical audiences.
- Working knowledge of SOC 2, ISO 27001, or similar frameworks, and the ability to turn them into a practical roadmap.
- Judgment: what's a material enterprise blocker vs. what can wait, and what you can answer yourself vs. what needs escalation.
- A track record of creating structure around manual or ambiguous work and improving the systems behind it.
- Strong written and verbal communication on risk, posture, and technical constraints, plus the project-management discipline to drive cross-functional work to completion.
- Comfort working across Engineering, Product, IT, Legal, Sales, Customer Success, and Support, and willingness to do operational work while reducing it over time.