Security GRC Lead

Job summary

Responsibilities

Mercor is creating a new category of work where expertise powers AI advancement. Achieving this requires an ambitious, fast-paced and deeply committed team. You’ll work alongside researchers, operators, and AI companies at the forefront of shaping the systems that are redefining society.

• The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act…
• A customer-audit machine that responds tocustomers
• The third-party risk program - formal intake, recurring review cadence, evidence requirements - tied into procurement so vendors can't be onboarded around it
• Policy lifecycle owned end-to-end: version, attestation, exception handling, review cycle - not a SharePoint graveyard
• Controls-as-code where it makes sense: integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection

What they're looking for

• 7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under audit by enterprise customers
• You've shipped at least one ISO 27001 certification from kickoff to issued certificate, including Stage 1 and Stage 2 with a real registrar
• Fluent in Vanta (or Drata, Secureframe, Sprinto) at the integration and admin level, not just the reviewer UI - you've configured connectors, written custom tests, debugged…
• You translate cloud-security language to auditor language and back without losing precision - you can read a Wiz finding, a Panther rule, an IAM policy, and say what control it…
• You write controls as code or query evidence with SQL when the platform falls short - Python, SQL, or shell, whatever it takes

Tech stack

• SQL
• Python