GRC Administrator

What you'll do

• Manage certification schedules, audit readiness, external auditors, and audit findings for SOC 2 Type II + HIPAA, ISO 27001:2022, and PCI DSS.
• Administer Drata and own control management, internal audits, policy lifecycle, and third-party vendor risk.
• Partner with department leaders and support customer trust requests and compliance reporting.

What they ask for

• Degree in Computer Science, IT, or a security-related discipline; equivalent compliance certifications (CRISC, CGRC, GRCP, CISM, or CISA) may substitute.
• 5+ years in information security compliance, GRC, or audit roles, including at least 2 years directly managing certification programs.
• Hands-on experience managing SOC 2 Type II audits end-to-end and demonstrated experience managing external audit firms through complete audit cycles.
• Working knowledge of HIPAA, ISO 27001:2022, and PCI DSS; expert-level proficiency with Drata or a comparable GRC/compliance automation platform.

Nice to have

• Certifications such as CISA, CISM, CRISC, ISO 27001 Lead Implementer/Lead Auditor, or CIPP.
• Experience adding frameworks to an existing program, in a cloud-first SaaS environment, or presenting to management and steering committees.

Tools

Drata, SOC 2 Type II, HIPAA, ISO 27001:2022, PCI DSS, Vanta, Secureframe, Hyperproof

AI focus

No AI-specific work is stated; the posting says AI tools transcribe and summarize interviews for internal hiring purposes.