Mercor
Security GRC Lead
$350K–$425K
San Francisco · On-site · Full-time · Posted Sep 9, 2026
- Experience
- 7+ years; at least 2 years owning a SOC 2 Type 2 program end-to-end.
About the job
Lead Mercor’s governance, risk, and compliance function, running audits and compliance programs while building customer assurance, third-party risk, and automated evidence processes.
What you'll do
- Own continuous SOC 2 monitoring, the ISO 27001 buildout, customer audits, and security-questionnaire responses.
- Build third-party risk, policy lifecycle, data-handling, and customer trust programs.
- Implement controls-as-code and automate evidence collection where appropriate.
What they ask for
- 7+ years in security GRC, compliance engineering, or audit, including at least 2 years owning a SOC 2 Type 2 program end-to-end at a company audited by enterprise customers.
- Shipped an ISO 27001 certification from kickoff through issuance, including Stage 1 and Stage 2 with a registrar.
- Fluent in Vanta or an alternative named platform at integration and admin level; able to configure connectors, custom tests, and troubleshoot evidence.
- Experience with customer-trust work, including questionnaires, auditor sessions, and disclosure letters under legal review.
Nice to have
- Experience in an AI lab, ML platform, or company serving frontier labs; familiarity with AI frameworks such as NIST AI RMF, EU AI Act, or ISO 42001.
- Experience with FedRAMP Moderate, HIPAA, PCI DSS, SOC 2 + HITRUST, LLM questionnaire automation, or building a third-party risk program.
Pay
$350K – $425K (base salary)
Tools
Vanta, Drata, Secureframe, Sprinto, Wiz, Panther, Python, SQL
AI focus
Uses LLMs and frontier models for GRC work, including evidence review, questionnaire drafting, and control mapping; may automate questionnaire responses.
Model-written summary · the original posting is authoritative