• Compliance lifecycle. Maintain ISO 27001 certification, prep for SOC 2 Type 1 and 2, manage auditor relationships, own evidence collection in Vanta. You'll know what's failing before the dashboard turns red, and the forecast of when the next certification is anticipated to complete.
• Vulnerability management as a program. Own the SLA layer — weekly dashboard, breach escalation, exception tracking, monthly view to leadership. Engineers fix the bugs; you make sure they fix them on time.
• Policy lifecycle. Annual reviews, new policies as scope expands, training rollout, attestation tracking, exception requests. We run reviews through an adversarial AI pipeline today; you'll own the cadence and the human decisions inside it.
• People-ops security controls. Onboarding/offboarding evidence, access reviews, security awareness training, background-check tracking, permission-management security groups. Partner with HR on the workflow, own the auditable artifact.
• Vendor risk. Vendor inventory, pre-procurement assessments, annual reassessments, DPA and sub-processor tracking.
• Customer-facing security. Security questionnaires, CAIQs, custom RFPs, customer security calls. You're the named SPM in our trust center.
• Product Terms of Service and Privacy Policy. Own the update cadence and the cross-functional process when product changes trigger policy revisions.
• Risk and incident program ownership. Maintain the risk register, run quarterly reviews, own the incident runbook artifact (technical response stays with Security Engineering), schedule and run tabletops.

• 4-7 years in security or GRC program management, ideally at a B2B SaaS company that grew through early stages.
• Lived experience running and owning ISO 27001 and SOC 2 audits end-to-end, including auditor management.
• Deep fluency in Vanta (or Drata/Tugboat with willingness to switch). You know what the platforms do well and where you have to compensate manually.
• Comfortable in front of customer security teams to both represent the capabilities of our security program as well as instill confidence in the team.
• Strong written communication.
• Good judgment on when a control gap is a real risk vs. a paperwork issue, and the ability to escalate issues quickly to the right audiences.

Bonus

• AI/ML security experience, especially model providers, prompt injection, data handling in agentic systems.
• Prior work at a company with a browser-based product (extensions, agents, scraping at scale).
• Experience standing up an additional framework (HIPAA, FedRAMP, ISO 27017/27018, C5).
• Background in pen-test coordination or bug bounty program management.