Role description
HightouchAbout the Role
We’re hiring our first dedicated GRC Lead to own customer security assurance and our compliance program. Your first priority will be making customer security reviews fast and accurate, alongside ownership of audits, compliance obligations, and risk follow-through.
We build quickly, and this role requires someone who can keep pace. You’ll understand the risks behind customer requirements, make practical recommendations, and drive decisions through to completion. You’ll have substantial autonomy and work directly with engineering, security, IT, legal, and our customer-facing teams.
We’re open to experienced individual contributors, managers who enjoy hands-on work, and people looking to grow into management. You’ll initially handle questionnaires, customer conversations, and audits directly, using AI and automation to increase what a small team can accomplish. As the function grows you’ll be able to grow with it.
What You’ll Own
Customer security reviews. Own questionnaires, due diligence, and customer security calls. Use AI to accelerate research and drafting, apply your own judgment to ensure precision, and resolve unfamiliar questions with the right technical experts.
Practical risk decisions. Help teams work through customer security requirements, vendor concerns, and compliance gaps. Understand what’s at stake, bring the right people together, and make sure decisions have clear owners and follow-through.
Reliable security answers. Maintain approved responses and supporting evidence. Use AI to surface inconsistencies and outdated information, and ensure answers accurately reflect differences across products, configurations, and planned capabilities.
Compliance strategy and audits. Own our SOC 2 and ISO 27001 programs, set priorities for external partners, assess their work, and close gaps. Ensure controls remain effective between audits, reuse controls across frameworks, and automate evidence collection. Evaluate new programs based on customer demand, the markets we want to enter, and the cost to implement and maintain them.
Execution and follow-through. Track commitments and remediation with clear owners and deadlines. Build automation and self-service resources that reduce repetitive work, and turn recurring customer questions into improvements to documentation, controls, and product.
About You
You’ve personally owned a compliance program or major audit cycle, and have hands-on experience with customer security reviews.
You bring:
Judgment. You can describe tradeoffs you’ve made, the risks you accepted or escalated, and why those decisions were reasonable.
Technical curiosity. You dig into how systems work and can discuss data flows, access controls, cloud infrastructure, and data storage with engineers.
AI fluency and attention to detail. You build AI-assisted workflows and catch convincing but unsupported answers. You know which details materially change a claim and how to verify them.
Clear writing and credible customer communication. You explain our security posture accurately, including when the answer is complicated or a capability doesn’t yet exist.
Ownership and urgency. You make progress with incomplete information, communicate clearly, and close loops without repeated prompting.
A builder’s approach. You’ve simplified a process, automated recurring work, or found a faster way to satisfy a requirement—and can explain the result.
This is a senior role, but we focus on impact and potential for growth more than years of experience. The salary range for this position is $160,000 to 230,000 USD per year, which is location independent in accordance with our remote-first policy. We also offer meaningful equity compensation.