Legora
GRC Lead
$151K–$273K
New York City · On-site · Full-time · Posted Jul 23, 2026
- Experience
- 6+ years; includes at least one B2B SaaS environment where the candidate owned SOC 2 and/or ISO 27001 end to end.
About the job
Owns Legora’s GRC and assurance programs, including certifications, AI governance, enterprise risk, policy, and business continuity.
What you'll do
- Manage SOC 2 Type II, ISO 27001, ISO/IEC 42001, and AI-agent assurance, including audits, evidence, and remediation.
- Run AI governance and regulatory compliance, translating requirements into controls with Legal.
- Own enterprise risk, policy lifecycle, and business continuity and disaster recovery (BCDR) programs.
What they ask for
- 6+ years in GRC, security compliance, or IT audit, including end-to-end SOC 2 and/or ISO 27001 ownership in at least one B2B SaaS environment.
- Working knowledge of AI governance frameworks and the EU AI Act, or demonstrated ability to quickly learn a new regulatory domain.
- Experience with continuous assurance, monitored controls, and pipeline-collected evidence.
- Ability to read code and infrastructure-as-code to verify controls.
Nice to have
- ISO 42001 Lead Auditor, ISO 27001 Lead Auditor, CISA, or CISSP (or equivalent experience).
- Experience with regulated buyers, privacy and cross-border data transfers, AI-agent assurance, or public-sector assurance.
Pay
$151K – $273K USD base salary
Tools
SOC 2 Type II, ISO 27001, ISO/IEC 42001, NIST AI RMF, EU AI Act, FedRAMP, IRAP, GDPR/CCPA
AI focus
Operate AI governance, inventory and classify AI systems and agents, address AI regulations, and guide assurance and certification for AI agents; use AI tools daily and assess which GRC workflows can be automated with AI.
Model-written summary · the original posting is authoritative