GRC Lead
$232,000–$273,000 year
On-siteNew York City, New York, United States
Job Summary
Own Legora's end-to-end assurance program, managing SOC 2 Type II, ISO 27001, and ISO/IEC 42001 certifications while expanding audit boundaries for new products and acquisitions. Build controls that map across frameworks to satisfy obligations like the EU AI Act and US state laws, ensuring evidence pipelines feed the Customer Trust team. Operate the AI governance program by tracking regulatory landscapes and translating them into concrete controls with Legal. Own the enterprise risk register, policy lifecycle, and business continuity program, including recovery objectives and tabletop exercises. Partner with Engineering to automate policy checks and collaborate with auditors, regulators, and customer security teams on risk decisions.
Required Qualifications
- 6+ years in GRC, security compliance, or IT audit
- Experience owning SOC 2 and/or ISO 27001 end to end in a B2B SaaS environment
- Working knowledge of AI governance frameworks (ISO 42001, NIST AI RMF) and the EU AI Act
- A demonstrated ability to get deep in a new regulatory domain fast
- Experience running a continuous-assurance operating model with monitored controls and pipeline-collected evidence
- Ability to read code and infrastructure-as-code well enough to verify a control yourself
- Experience running enterprise risk processes that leadership uses to make decisions
- Clear, precise writing ability to produce policies and risk narratives read by lawyers
- Daily use of AI tools in own work with specific, grounded views on which GRC workflows AI can run today and which it cannot
Desired Qualifications
- ISO 42001 Lead Auditor certification
- ISO 27001 Lead Auditor certification
- CISA certification
- CISSP certification
- Equivalent experience to certifications
- Experience selling trust to law firms, financial services, or other heavily regulated buyers
- Experience with GDPR/CCPA and cross-border data transfer requirements
- Exposure to AI-agent assurance or certification of AI products
- Exposure to public-sector assurance (e.g., FedRAMP, IRAP)
Hiring someone like this?
Get your role in front of qualified candidates on Sorce.