Вакансии

Responsibilities: — Enhance security governance, risk management, and compliance across enterprise systems and IT infrastructure. Requirements: — Bachelor's degree in Cybersecurity or related field. — Professional experience in Information Security GRC. — Familiarity with GRC and risk management tools. — Knowledge of ISO 27001, SOC 2, NIST frameworks. — Experience with security risk assessments and compliance monitoring. — Strong analytical and communication skills. — Fluency in English and Russian. Benefits: — Assistance with relocation.

Location: Denver, Colorado, United States, AMER From Fivetran’s founding until now, our mission has remained the same: to make access to data as simple and reliable as electricity. With Fivetran, customer data arrives in their warehouses, canonical and ready to query, with no engineering or maintenance required. We’re proud that more organizations continue to leverage our technology every day to become truly data-driven. About Us Fivetran and dbt Labs are bringing together two industry-leading companies with a shared mission: helping organizations unlock the full value of their data. Together, we’re delivering the data infrastructure layer that helps organizations move, transform, and trust their data — from the moment data moves, through every transformation, to the context teams and AI systems rely on. Fivetran helps organizations automate data movement across the systems, clouds, engines, and tools they rely on. dbt Labs pioneered analytics engineering, helping teams transform data into reliable, governed insights. Together, we support thousands of organizations as they build a trusted foundation for analytics, AI, and better business decisions. As we bring our teams and technology together, we’re building on the strengths of both companies while continuing to deliver the products and experiences our customers know and trust. It’s an exciting time to join us: we’re creating a company with the scale, talent, and technology to help more organizations put their data to work with greater speed, confidence, and impact. During this transition period, you may see references to both Fivetran and dbt Labs throughout our recruiting process as we integrate our teams, systems, and career sites. About the Role The Fivetran information security organization is a motivated and innovative team responsible for ensuring the continuous integrity, confidentiality, and availability of customers’ data. Our customers trust us with all their most sensitive information, and we consider maintaining that trust to be a critical, core component of our product and business. Fivetran is seeking a motivated candidate for a GRC Senior Engineer of the Security Team. The role requires a compliance-focused engineer with knowledge and expertise in building data sets that will be used to turn our compliance into a continuous data-driven function. The position reports to the Director, GRC. Will build and own a security data lake that aggregates evidence and telemetry from across our environment, and use it to power continuous control monitoring (CCM) that replaces manual control testing with automation. You will also support core GRC operations, including internal and external audits, risk management, and vendor assessments. Acts as a subject matter expert within specific responsibility area(s) and applies internal audit best practices and keeps current with applicable rules and regulations for security compliance frameworks, as well as any authoritative pronouncements issued by relevant governing bodies. Advanced security risk or audit certifications are required and leading cybersecurity certifications are preferred. This is a full-time position based out of our Denver office . Our hybrid work model offers a blend of remote flexibility and in-person collaboration, including two days in the office each week to connect and build as a team. Technologies You’ll Use AWS, GCP, Azure, Kubernetes, Secureframe, Wiz, GitHub What You’ll Do You will build and maintain a security data lake on Fivetran itself, using our own platform to centralize the data that powers continuous control monitoring. Govern the lake itself: enforce data quality, retention, least-privilege access, and sensitive-data handling Build compliance-as-code: automated evidence collection, continuous control monitoring, and policy-as-code checks across cloud (AWS, GCP, Azure), Kubernetes, CI/CD pipelines, identity, and SaaS systems Integrate and extend GRC tooling and internal platforms with APIs, scripts, and workflows that replace manual audit work and give real-time visibility into control health Support Fivetran's certifications and attestations: ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST Skills We’re Looking For 5+ years in GRC, security engineering, data engineering, or a related fieldUnderstanding and ability to perform control testing, documentation, and control design Strong SQL and proficiency in Python (or similar) for automation and data transformation Hands-on experience with a modern data stack (cloud warehouse/lake, ETL/ELT, orchestration, transformation tooling) Experience automating control testing or replacing manual compliance processes with code-driven checks Working knowledge of several of: ISO 27001 family, SOC 2, PCI DSS, HITRUST Familiarity with cloud security controls in [AWS / GCP / Azure] and common SaaS security configurations Ability to translate control language into technical tests, and technical results into audit-ready narratives Clear written communication and comfort working across Security, IT, Engineering, Legal, and Finance Bonus Skills ​ Experience in dealing with external audits Professional audit or information security certifications preferred (CISA, CISSP, AWS, SANS GIAC, etc.). An understanding of control frameworks Fivetran follows: SOC 1/2, PCI-DSS, ISO 27001, NIST 800-53, ISO 27017, ISO 27018, ISO 27701, ISO 42001, HITRUST, FedRAMP The compensation range displayed on this job posting reflects the minimum and maximum target for new hire compensation for the target position and level, and may include sales incentives or target bonuses depending on the role.  Our compensation ranges are determined by role, level, and location. Our job titles may span more than one career level. Within the range, individual compensation is determined by additional factors, including job-related skills, experience, relevant education or training, business need, market demands. The compensation range is subject to change and may be modified in the future. Your recruiter can share more about the specific compensation range for your location during the hiring process. Pay Range $148,788 — $185,984.75 USD Perks and Benefits 100% employer-paid medical insurance * Generous paid time away from work, including paid vacation or flexible/unlimited vacation depending on role and country, plus paid sick time, inclusive parental leave, paid holidays, including a year-end Global Week of Rest, and volunteer days off. RSU stock grants* Professional development and training opportunities Company virtual happy hours, free food, and fun team-building activities Monthly cell phone stipend Access to an innovative mental health support platform that offers personalized care and resources in areas such as: therapy, coaching, and self-guided mindfulness exercises for all covered employees and their covered dependents. * May vary by country and worker type - please reach out to your recruiter for more information Click here to learn more about Fivetran's Benefits by Region. We’re honored to be valued at over $5.6 billion , but more importantly, we’re proud of our core values of Get Stuck In, Do the Right Thing, and One Team, One Dream . Read about us in Forbes . Fivetran brings together high-quality talent across the globe to make data access as easy and reliable as electricity for our customers. We value and recognize that our customers benefit from having innovative teams made of people from many backgrounds, experiences, and identities. Fivetran promotes diversity, equity, inclusion & belonging through attracting, recruiting, developing, and retaining a diverse workforce, not only because it is the right thing to do, but because it helps us build a world-class company to better serve our customers, our people and our communities. To learn more about Fivetran’s culture and what it’s like to be part of the team, click here and enjoy our video. To learn more about our candidate privacy policy, you can read our statement here . We are committed to ensuring that all candidates have an equal opportunity to participate in our interview process. If you require accommodations at any stage of the process due to a disability, medical condition, or any other circumstance, please don't hesitate to submit your request by filling out this form . We will work with you to provide reasonable accommodations to facilitate your participation and ensure a fair and accessible interview experience. Your request and any information provided will be kept confidential and will not impact your candidacy. We look forward to hearing from you and accommodating your needs to the best of our ability.

Location: Oakland, California, United States From Fivetran’s founding until now, our mission has remained the same: to make access to data as simple and reliable as electricity. With Fivetran, customer data arrives in their warehouses, canonical and ready to query, with no engineering or maintenance required. We’re proud that more organizations continue to leverage our technology every day to become truly data-driven. About Us Fivetran and dbt Labs are bringing together two industry-leading companies with a shared mission: helping organizations unlock the full value of their data. Together, we’re delivering the data infrastructure layer that helps organizations move, transform, and trust their data — from the moment data moves, through every transformation, to the context teams and AI systems rely on. Fivetran helps organizations automate data movement across the systems, clouds, engines, and tools they rely on. dbt Labs pioneered analytics engineering, helping teams transform data into reliable, governed insights. Together, we support thousands of organizations as they build a trusted foundation for analytics, AI, and better business decisions. As we bring our teams and technology together, we’re building on the strengths of both companies while continuing to deliver the products and experiences our customers know and trust. It’s an exciting time to join us: we’re creating a company with the scale, talent, and technology to help more organizations put their data to work with greater speed, confidence, and impact. During this transition period, you may see references to both Fivetran and dbt Labs throughout our recruiting process as we integrate our teams, systems, and career sites. About the Role The Fivetran information security organization is a motivated and innovative team responsible for ensuring the continuous integrity, confidentiality, and availability of customers’ data. Our customers trust us with all their most sensitive information, and we consider maintaining that trust to be a critical, core component of our product and business. Fivetran is seeking a motivated candidate for a GRC Senior Engineer of the Security Team. The role requires a compliance-focused engineer with knowledge and expertise in building data sets that will be used to turn our compliance into a continuous data-driven function. The position reports to the Director, GRC. Will build and own a security data lake that aggregates evidence and telemetry from across our environment, and use it to power continuous control monitoring (CCM) that replaces manual control testing with automation. You will also support core GRC operations, including internal and external audits, risk management, and vendor assessments. Acts as a subject matter expert within specific responsibility area(s) and applies internal audit best practices and keeps current with applicable rules and regulations for security compliance frameworks, as well as any authoritative pronouncements issued by relevant governing bodies. Advanced security risk or audit certifications are required and leading cybersecurity certifications are preferred. This is a full-time position based out of our Oakland office . Our hybrid work model offers a blend of remote flexibility and in-person collaboration, including two days in the office each week to connect and build as a team. Technologies You’ll Use AWS, GCP, Azure, Kubernetes, Secureframe, Wiz, GitHub What You’ll Do You will build and maintain a security data lake on Fivetran itself, using our own platform to centralize the data that powers continuous control monitoring. Govern the lake itself: enforce data quality, retention, least-privilege access, and sensitive-data handling Build compliance-as-code: automated evidence collection, continuous control monitoring, and policy-as-code checks across cloud (AWS, GCP, Azure), Kubernetes, CI/CD pipelines, identity, and SaaS systems Integrate and extend GRC tooling and internal platforms with APIs, scripts, and workflows that replace manual audit work and give real-time visibility into control health Support Fivetran's certifications and attestations: ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 42001, PCI DSS, SOC 2, and HITRUST Skills We’re Looking For 5+ years in GRC, security engineering, data engineering, or a related fieldUnderstanding and ability to perform control testing, documentation, and control design Strong SQL and proficiency in Python (or similar) for automation and data transformation Hands-on experience with a modern data stack (cloud warehouse/lake, ETL/ELT, orchestration, transformation tooling) Experience automating control testing or replacing manual compliance processes with code-driven checks Working knowledge of several of: ISO 27001 family, SOC 2, PCI DSS, HITRUST Familiarity with cloud security controls in [AWS / GCP / Azure] and common SaaS security configurations Ability to translate control language into technical tests, and technical results into audit-ready narratives Clear written communication and comfort working across Security, IT, Engineering, Legal, and Finance Bonus Skills ​ Experience in dealing with external audits Professional audit or information security certifications preferred (CISA, CISSP, AWS, SANS GIAC, etc.). An understanding of control frameworks Fivetran follows: SOC 1/2, PCI-DSS, ISO 27001, NIST 800-53, ISO 27017, ISO 27018, ISO 27701, ISO 42001, HITRUST, FedRAMP The compensation range displayed on this job posting reflects the minimum and maximum target for new hire compensation for the target position and level, and may include sales incentives or target bonuses depending on the role.  Our compensation ranges are determined by role, level, and location. Our job titles may span more than one career level. Within the range, individual compensation is determined by additional factors, including job-related skills, experience, relevant education or training, business need, market demands. The compensation range is subject to change and may be modified in the future. Your recruiter can share more about the specific compensation range for your location during the hiring process. Pay Range $158,707 — $198,383.50 USD Perks and Benefits 100% employer-paid medical insurance * Generous paid time away from work, including paid vacation or flexible/unlimited vacation depending on role and country, plus paid sick time, inclusive parental leave, paid holidays, including a year-end Global Week of Rest, and volunteer days off. RSU stock grants* Professional development and training opportunities Company virtual happy hours, free food, and fun team-building activities Monthly cell phone stipend Access to an innovative mental health support platform that offers personalized care and resources in areas such as: therapy, coaching, and self-guided mindfulness exercises for all covered employees and their covered dependents. * May vary by country and worker type - please reach out to your recruiter for more information Click here to learn more about Fivetran's Benefits by Region. We’re honored to be valued at over $5.6 billion , but more importantly, we’re proud of our core values of Get Stuck In, Do the Right Thing, and One Team, One Dream . Read about us in Forbes . Fivetran brings together high-quality talent across the globe to make data access as easy and reliable as electricity for our customers. We value and recognize that our customers benefit from having innovative teams made of people from many backgrounds, experiences, and identities. Fivetran promotes diversity, equity, inclusion & belonging through attracting, recruiting, developing, and retaining a diverse workforce, not only because it is the right thing to do, but because it helps us build a world-class company to better serve our customers, our people and our communities. To learn more about Fivetran’s culture and what it’s like to be part of the team, click here and enjoy our video. To learn more about our candidate privacy policy, you can read our statement here . We are committed to ensuring that all candidates have an equal opportunity to participate in our interview process. If you require accommodations at any stage of the process due to a disability, medical condition, or any other circumstance, please don't hesitate to submit your request by filling out this form . We will work with you to provide reasonable accommodations to facilitate your participation and ensure a fair and accessible interview experience. Your request and any information provided will be kept confidential and will not impact your candidacy. We look forward to hearing from you and accommodating your needs to the best of our ability.

Location: Remote (United States | Canada) Workplace: Remote 1Password is growing. We’ve surpassed $500M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up with iconic partners like Oracle Red Bull Racing. About 1Password At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Unified Access Management, a new cybersecurity category built for the way people and AI agents work today. As one of the most loved brands in cybersecurity, we take a human-centric approach in everything from product strategy to user experience. Over 180,000 businesses, from Fortune 100 leaders to the world’s most innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work. If you're excited about the opportunity to contribute to the digital safety of millions, to work alongside a team of curious, driven individuals, and to solve hard problems in a fast-paced, dynamic environment, then we want to hear from you. Come join us and help shape a safer, simpler digital future. As a Security Engineer on the Governance, Risk, and Compliance (GRC) team, you’ll help build and scale programs that support commercial audits, federal compliance, security risk management, vendor risk, policy management, and customer trust. You’ll turn complex requirements into practical controls, reliable workflows, and measurable improvements while partnering across Security, Engineering, Legal, Privacy, and other teams. You’ll be expected to identify opportunities where AI can improve GRC workflows and turn useful experiments into practical, reliable solutions. Your work will help 1Password protect the people, businesses, and digital experiences that depend on secure access every day. How we’re using AI today Our Engineering, Product, and Design teams are thoughtfully integrating AI across the full software and product development lifecycle to move faster without sacrificing quality or security. In practice, that looks like engineers using AI-assisted coding tools to accelerate reviews and catch bugs earlier, product managers synthesizing user research at scale, and designers rapidly prototyping and iterating with AI-generated mockups. We approach AI the same way we approach security: with clear principles, human accountability at every consequential decision point, and rigorous evaluation before anything ships to customers. This is a remote opportunity within Canada and the US. What we're looking for: • Bring three or more years of experience in security, compliance, risk, audit, GRC, program management, or a related technical discipline. • Manage moderately complex, cross-functional compliance or security initiatives with a high degree of organization, ownership, and follow-through. • Apply one or more security or compliance frameworks, such as SOC 2, ISO 27001, NIST 800-53, CMMC, FedRAMP, PCI DSS, or similar standards. • Support FedRAMP or comparable federal compliance programs, ideally in a program management, project management, or cross-functional coordination capacity. Familiarity with authorization boundaries, assessment preparation, Plans of Action and Milestones (POA&Ms), continuous monitoring, Third-Party Assessment Organization (3PAO) coordination, or remediation is valuable. • Translate framework requirements into clear control activities, policies, procedures, test cases, evidence requirements, and operational workflows. • Work with GRC platforms such as Drata, Tines, Vanta, ServiceNow, Archer, LogicGate, Secureframe, or comparable tools, and use automation techniques such as APIs, scripts, webhooks, ticketing workflows, and cloud or identity integrations. • Actively use AI in day-to-day work and show a clear trajectory toward building with it, including experimenting with or configuring AI-assisted workflows for GRC, security, risk, or compliance tasks. Understand the need for validation, human judgment, reliable controls, and appropriate review before relying on AI-generated outputs. What you can expect: • Manage GRC initiatives spanning commercial compliance, federal compliance, security risk, vendor risk, policy management, and customer trust. • Support planning, assessment preparation, remediation, and continuous monitoring activities for FedRAMP, CMMC, NIST 800-53, and related programs. • Partner with control owners, Security, Engineering, Legal, Privacy, auditors, assessors, and business stakeholders to gather evidence, track actions, and resolve gaps. • Define and improve how evidence is generated, validated, mapped to requirements, stored, and traced to its source. • Monitor control health, evidence freshness, configuration drift, exceptions, and remediation progress. • Build or configure automated and AI-assisted workflows that reduce manual effort and improve the reliability of compliance and risk processes. • Maintain project plans, action trackers, risk logs, documentation, and status updates while contributing to repeatable team practices and knowledge sharing. USA-based roles only: The annual base salary for this role is between $123,000 USD and $172,000 USD, plus immediate participation in 1Password's benefits program (health, dental, 401k and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. Canada-based roles only: The annual base salary for this role is between $111,000 CAD and $155,000 CAD, plus immediate participation in 1Password’s generous benefits program (health, dental, RRSP and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. At 1Password, we approach each individual's compensation with a promise of fair market value and internal equity commensurate with experience and specific skill set. This posting is for an existing vacancy. Our culture At 1Password, we prioritize collaboration, clear and transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first. You’ll be part of a team that challenges the status quo, and is excited to experiment and iterate in search of the best solution. That said, 1Password is not for everyone https://blog.1password.com/inside-the-culture-powering-1passwords-next-chapter/. Our work is demanding, we strive for excellence, and the pace is fast. We need people who are keen to take on challenging problems, who seek feedback to grow, and who are driven to make an impact. If you're looking for a place where you can settle into a comfortable routine, this might not be the right fit for you. We’re looking for individuals who are proven experts in their fields, as well as those who are highly adaptable, can thrive in ambiguity and through change, are curious, and above all deliver results. How we work with AI We are committed to leveraging cutting-edge technology—including AI—to achieve our mission. We also understand that thinking critically about AI in its current forms will help us create better solutions for our customers and ourselves with its future forms, which will help us continue to close the gap between security and privacy and achieve our mission. We want team members at all levels to take the approach of actively learning AI best practices, identifying opportunities to apply AI in meaningful ways, and driving innovative solutions in their daily work. Embracing the future of AI isn't just encouraged—it's an essential part of how we will be successful at 1Password. This approach extends to our hiring process—candidates are welcome to use AI tools responsibly and thoughtfully during the application process. To us, this means we do ask that you join live interviews without using AI tools so we can get to know how you communicate, solve problems, and collaborate with others. Our approach to remote work We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events. What we offer We believe in working hard, and rewarding that hard work through our benefits. While not an exhaustive list, here is a glance at what we currently offer: Health and wellbeing 👶 Maternity and parental leave top-up programs 🩺 Competitive health benefits 🏝 Generous PTO policy Growth and future 📈 RSU program for most employees 💸 Retirement matching program 🔑 Free 1Password account Community 🤝 Paid volunteer days 🏆 Peer-to-peer recognition through Bonusly 🌎 Remote-first work environment *Some roles in our GTM team are currently being hired for in-person hybrid work in Toronto and Austin. These roles will specify on the posting. You belong here. 1Password is proud to be an equal opportunity employer. We are committed to fostering an inclusive, diverse and equitable workplace that is built on trust, support and respect. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, colour, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken or veteran status. Be yourself, find your people and share the things you love. Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email us at nextbit@agilebits.com and we’ll work to meet your needs. Remote work is a part of our DNA. Given that our company was founded remotely in 2005, we can safely say we're experts at building remote culture. That said, remote work at 1Password does mean working from your home country. If you've got questions or concerns about this, your talent partner would be happy to address them with you. Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law. 1Password uses artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing and predictive analytics, to assist in the initial screening of employment applications and improve our recruitment process. See here https://www.ashbyhq.com/downloadables/ashby-bias-audit-08-2024.pdf for the latest third party bias audit information. If you prefer not to have your application assessed using AI/ML features, you may opt out by completing this form https://jobs.ashbyhq.com/1password/automation-notice. For additional information see our Candidate Privacy Notice https://1password.com/files/candidate-privacy-notice.pdf.

Location: Riyadh, Saudi Arabia Role Summary The GRC Senior Specialist provides governance, risk management and compliance consultancy to Saudi Motorsport Company. The role owns the cybersecurity governance framework and keeps SMC compliant with NCA and other Saudi regulations. Key Responsibilities Develop, review and maintain cybersecurity policies, standards and procedures Lead compliance with NCA ECC, CCC, and other applicable frameworks (PDPL, ISO 27001) Run gap assessments and build remediation roadmaps with control owners Own the cybersecurity risk register: identify, assess, treat and report risks Conduct third-party and vendor risk assessments Prepare SMC for internal, external and NCA audits, and manage evidence collection Track compliance status and present risk and compliance reports to senior management Support business continuity and disaster recovery planning from a security angle Run security awareness programs and policy communication across the organization Advise business and IT teams on regulatory and security requirements for new projects Requirements Requirements Bachelor's degree in Cybersecurity, Information Systems, IT or related field 7+ years in cybersecurity GRC, with at least 3 years in KSA Proven hands-on experience implementing NCA ECC and CCC, including NCA self-assessments Strong knowledge of ISO 27001, ISO 31000, NIST CSF and the Saudi PDPL Experience writing policies and leading audits end to end Familiarity with GRC platforms (ServiceNow IRM/GRC, RSA Archer, MetricStream) is a plus Saudi national, fluent in Arabic and English, with strong report writing skills Preferred Certifications CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer or Lead Auditor

Location: Remote, United States GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role GitLab is seeking an experienced Principal Security GRC Manager, Legal Assurance to tackle complex customer security challenges at the intersection of technical architecture and business requirements. In this role, you'll apply deep security expertise to answer technical questions, assess contract requirements, and enable GitLab’s Sales and field organizations to address security problems for enterprise customers. You'll work directly with customers and internal teams to provide technical guidance, create security content, and help customers understand how GitLab's security controls meet their compliance and risk management needs. What you'll do: Contract & Legal Review Perform comprehensive contract reviews for both customer agreements and vendor relationships Analyze security and compliance clauses in legal documents Provide risk-based recommendations and remediation guidance for contractual security requirements Partner with Legal, Sales, Product, and Procurement teams to negotiate security-related contract terms. Manage escalations, collaborate across other teams, and develop solutions to enable team and business partners to close deals Document and track contract-related security obligations Customer Engagement & Assurance Join customer and prospect meetings to provide expert guidance on GitLab’s security practices and controls in order to address security, privacy, and compliance requirements Build and maintain templates, playbooks, fallback positions, and training that simplify and accelerate negotiations Facilitate customer assurance activities through our Customer Assurance Activities Service Desk Provide escalation support for complex security questionnaires, RFPs, and risk assessments Serve as security point of contact for enterprise customer questions, requests, and concerns Security Evangelism & Thought Leadership Act as a trusted technical thought leader, developing internal and external security content such as blog posts, whitepapers, technical standards, and field sales enablement training materials Keep abreast of the rapidly evolving regulatory landscape affecting our agreements. Identify, track, and facilitate solutions for security related customer trends and improvement areas Build and strengthen GitLab's security brand within the industry Strategic Initiatives Maintain and enhance GitLab's Trust Center and self-service security resources Provide strategic recommendations based on customer security concerns in support of revenue growth Participate in Quarterly Business Reviews to inform product and security roadmap decisions Mentor and provide guidance to Security Assurance team members Drive continuous improvement of Field Security processes and documentation Design and implement solutions to enable Sales facing teams to successfully discuss security problems and topics with customers What you'll bring: Expertise in law and regulation such as (GDPR, CCPA, DORA, EU AI Act) Deep experience in information security, with at least 5 years in customer-facing security roles Deep experience in security frameworks and standards such as (SOC 2, ISO 27001/27017/27018/42001, FedRAMP, NIST CSF, etc.) Proven track record of contract negotiation and security/privacy agreement reviews Exceptional written and verbal communication skills with ability to translate complex technical concepts for diverse audiences Experience creating security content (blogs, whitepapers, presentations) Strong understanding of cloud security, SaaS security models, and DevSecOps practices Experience working cross-functionally with Sales, Legal, Product, and Engineering teams Ability to balance security risk with business objectives Experience speaking at conferences is a plus Preferred: One or more relevant certifications such as CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM. Equivalent demonstrated experience is equally valued. Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position. About the team The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk. Security Governance sits within it and owns customer trust, security awareness, policies and standards, and other governance functions. Our counterparts are Security Compliance, Security Risk, and GRC Engineering. You will join a small team of four direct reports under the Director, where each person has broad scope and visible impact. We work remote-first and asynchronously, and we write things down and share them openly. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity . Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $203,200 — $285,000 USD How GitLab Supports Full-Time Employees Benefits to support your health, finances, and well-being Flexible Paid Time Off Team Member Resource Groups Equity Compensation & Employee Stock Purchase Plan Growth and Development Fund Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law . If you have a disability or special need that requires accommodation , please let us know during the recruiting process .

Location: Remote What you’ll be part of Garner is on a mission to transform the U.S. healthcare system — and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster. The result is a rare “win win” — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can. About the role: We are looking for a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner’s security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program. You will partner with all departments across the company so that risks are identified early, decisions are made deliberately, and remediation actually gets done. Our Technology Compliance team safeguards Garner’s sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow. Where you will work: This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week. What you will do: Own Garner’s annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting Manage risk exceptions and prepare risk acceptances for leadership decision Run third party and vendor risk reviews from intake through approval and periodic reassessment Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking Manage the maintenance of our compliance policies, standards, and procedures Report on our compliance posture to senior leadership Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest What you will bring to the team: 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005 Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment Working knowledge of HIPAA and of SOC 2, ISO 27001, and HITRUST requirements A track record of driving accountability across teams you don’t manage, and the ability to adapt your communication style across engineers, operators, and executives A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred Technologies we use: AWS, Okta, Wiz, Retool, Gitlab, Vanta, Claude Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time. Compensation Transparency: The target salary range for this position is $155,000-185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k) with company match, flexible spending accounts, Teladoc Health and more. Fraud and Security Notice: Please be aware of recent job scam attempts. Our recruiters use getgarner.com and garnerhealth.com email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement here and to candidateprotection@garnerhealth.com . Equal Employment Opportunity: Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at talent@garnerhealth.com .

Location: Remote - United States Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit users submit, vote, and comment on the topics they care most about. With 100,000+ active communities and approximately 130 million daily active unique visitors, Reddit is one of the internet’s largest sources of information. For more information, visit www.redditinc.com . Team Description The Privacy and Compliance Engineering team is responsible for preparing Reddit’s platforms for evolving regulatory requirements. We’re building products that establish the foundation of trust in the Reddit platform, while partnering closely with teams across the company to ensure our platforms and features meet the highest standards. Engineers on this team will thrive in dynamic, ambiguous problem spaces and work across multiple domains and technology stacks. Role Description We’re hiring a GRC Software Engineer to build and improve the software that supports Reddit’s security and compliance programs. You will design, implement, and maintain integrations, data pipelines, scheduled workflows, and automated checks across cloud, identity, HR, finance, code, and ticketing systems. Working closely with engineering and business partners, you’ll translate requirements into reliable tools that surface issues early and reduce manual work. You’ll own projects from discovery through launch, make clear technical trade-offs, and establish sustainable support with engineering partners. How You’ll Have Impact: This role will make Reddit’s compliance programs more effective and scalable by building systems that help teams address requirements early and automate recurring assurance work. You’ll work with engineers and control owners to define clear requirements, deliver practical solutions, and follow through after launch. Your work will improve how controls operate, make evidence more timely and reliable, and surface gaps sooner. Success means dependable systems that teams continue to use, less manual work, faster remediation, and clearer visibility into risk. What You’ll Do: Own software projects from discovery through launch: work with partners to define the problem, agree on success measures, make technical trade-offs clear, deliver the solution, and follow through on results. Lead efforts to automate evidence collection across key systems in scope for SOX and other compliance requirements. Work with control owners and system teams to define evidence requirements, build and validate integrations, monitor failures, and establish ongoing support. Build and maintain integrations and scheduled workflows across cloud, identity, HR, finance, ticketing, version control, CI/CD, and GRC systems. Use APIs, scripts, queries, and orchestration tools to collect, normalize, validate, and retain data from authoritative systems. Own authentication, data modeling, testing, monitoring, failure recovery, documentation, and maintenance. Design data models that connect risks, controls, assets, owners, systems, and evidence across sources with different schemas, identifiers, permissions, and data quality. Build automated checks that detect missing, stale, inconsistent, or out-of-policy data, and route actionable failures to the right owners. Turn control requirements and audit requests into data specifications, testable checks, and exception logic. Partner with control owners to validate system scope and resolve gaps. Build strong working relationships across Security, Engineering, Infrastructure, Product, Privacy, Legal, and Finance. Learn how their systems operate and deliver tools, monitoring, and runbooks they can rely on after launch. Role Requirements: 7+ years of experience in security, compliance, automation, data integration, security engineering, or a related technical field. Hands-on proficiency with Python, Go, or a comparable language and SQL, including writing, testing, reviewing, and maintaining code used by other people or operational workflows. Experience building API-based integrations using REST APIs, webhooks or polling, authentication flows, pagination, rate limits, error handling, and structured data formats. Experience building scheduled data workflows with an orchestrator such as Airflow and moving validated data between enterprise SaaS systems, databases, and cloud object storage. Technical fluency with a major cloud platform and its identity, storage, logging, monitoring, and secrets-management services; GCP experience is helpful but not required. Experience with version control, automated testing, code review, CI/CD, observability, secure credential handling, failure recovery, and the runbooks needed to support an integration after launch. Practical knowledge of security and compliance controls, including how requirements translate into system design, evidence, testing, and remediation. Experience applying one or more relevant frameworks or regulatory requirements, such as SOC 2, ISO 27001, SOX ITGC, NIST CSF, EU DSA, or EU NIS 2. Demonstrated ability to earn trust and influence without authority by listening carefully, making risk and technical trade-offs clear, reducing partner burden where possible, addressing concerns directly, and following through on commitments. You can independently own complex projects from discovery through launch and measurable results. Benefits: Comprehensive Healthcare Benefits and Income Replacement Programs 401k with Employer Match Global Benefit programs that fit your lifestyle, from workspace to professional development to caregiving support Family Planning Support Gender-Affirming Care Mental Health & Coaching Benefits Flexible Vacation & Paid Volunteer Time Off Generous Paid Parental Leave Pay Transparency: This job posting may span more than one career level. In addition to base salary, this job is eligible to receive equity in the form of restricted stock units, and depending on the position offered, it may also be eligible to receive a commission. Additionally, Reddit offers a wide range of benefits to U.S.-based employees, including medical, dental, and vision insurance, 401(k) program with employer match, generous time off for vacation, and parental leave. To learn more, please visit https://www.redditinc.com/careers/ . To provide greater transparency to candidates, we share base salary ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar stage growth companies. Final offer amounts are determined by multiple factors including, skills, depth of work experience and relevant licenses/credentials, and may vary from the amounts listed below. The base salary range for this position is: $190,800 — $267,100 USD In select roles and locations, the interviews will be recorded, transcribed and summarized by artificial intelligence (AI). You will have the opportunity to opt out of recording, transcription and summarization prior to any scheduled interviews. During the interview, we will collect the following categories of personal information: Identifiers, Professional and Employment-Related Information, Sensory Information (audio/video recording), and any other categories of personal information you choose to share with us. We will use this information to evaluate your application for employment or an independent contractor role, as applicable.  We will not sell your personal information or disclose it to any third party for their marketing purposes.  We will delete any recording of your interview promptly after making a hiring decision.  For more information about how we will handle your personal information, including our retention of it, please refer to our Candidate Privacy Policy for Potential Employees and Contractors . Reddit is proud to be an equal opportunity employer, and is committed to building a workforce representative of the diverse communities we serve.  Reddit is committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If, due to a disability, you need an accommodation during the interview process, please let your recruiter know.

Location: United Kingdom - Remote Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. Security Engineer, Governance, Risk & Compliance (EMEA) The role: GRC work is at its best when it makes security clearer, more consistent, and easier to operate. As a Security Engineer focused on Governance, Risk & Compliance, you’ll help maintain and improve Chainguard’s compliance and risk programs while building the experience and judgment to take on broader ownership over time. You’ll work closely with experienced security and GRC partners to support SOC 2 Type II and ISO 27001 audit readiness, keep evidence and controls organized, help manage risk and remediation work, and improve the systems and processes behind our compliance program. This is an earlier-career, hands-on role. You don’t need to have led an audit or built a GRC function before. We’re looking for someone with strong organizational habits, good judgment, curiosity, and a willingness to learn. You’ll have clear areas of responsibility, regular opportunities to work cross-functionally, and support from teammates as you grow your expertise. Chainguard is building the secure foundation for software development and deployment. You’ll contribute to that mission by helping our security practices remain effective, measurable, and worthy of our customers’ trust. What you’ll do: Support audit readiness activities for SOC 2 Type II, ISO 27001, and other security assurance initiatives. Coordinate evidence collection with teams across Security, Engineering, Legal, HR, Product, and other functions. Help maintain security policies, standards, procedures, control descriptions, and supporting documentation. Assist with control testing, risk assessments, gap analysis, and remediation tracking. Keep compliance and risk information accurate and up to date in GRC platforms such as Vanta. Help translate auditor, customer, and internal security requests into clear next steps for the right stakeholders. Track action items, follow up on dependencies, and communicate status, risks, and blockers clearly. Identify opportunities to simplify and improve GRC workflows through better documentation, automation, and use of modern tooling. Develop and maintain repeatable processes, checklists, runbooks, and evidence-collection practices. Support customer security reviews, questionnaires, and third-party risk activities as needed. Learn Chainguard’s systems and security practices well enough to ask useful questions, identify inconsistencies, and escalate potential risks with clear context. Partner with senior members of the Security and Governance, Risk & Compliance teams on projects that improve Chainguard’s security posture. What we’re looking for: 2+ years of experience in information security, GRC, compliance, audit, risk, IT, or a related field; equivalent practical experience is welcome. Experience supporting audits, control activities, risk assessments, security questionnaires, or compliance programs. Strong organizational and project coordination skills, with the ability to manage details across multiple workstreams. Clear written and verbal communication skills, including the ability to explain requests and findings to both technical and non-technical stakeholders. A structured, detail-oriented approach to documentation, evidence management, and follow-through. Curiosity about how technology and security controls work, with the confidence to ask questions and investigate unfamiliar topics. Comfort working with spreadsheets, documentation systems, ticketing tools, and GRC platforms. An interest in improving repetitive processes through automation, better tooling, or clearer workflows. A collaborative, team-first approach and the ability to work effectively with colleagues across regions and functions. Comfort working in a fast-moving environment where priorities and processes continue to evolve. Nice to have: Experience with SOC 2, ISO 27001, NIST, or another security or assurance framework. Familiarity with GRC platforms such as Vanta, Drata, or similar tools. Experience with control testing, risk registers, remediation plans, or policy management. Exposure to cloud environments, SaaS applications, software development practices, or security operations. Familiarity with third-party risk management or customer security reviews. Experience improving workflows with automation, integrations, or lightweight scripting. Why you’ll love it here: We take security seriously without making it unnecessarily complicated. At Chainguard, you’ll: Learn by doing: Work on real security and assurance programs with support from experienced teammates. Challenge the status quo: Help simplify processes, improve tooling, and find better ways to get important work done. Collaborate across borders: Partner with colleagues across EMEA and the broader Chainguard organization. Grow your scope: Build the technical judgment and program-management skills needed to take on increasingly complex security initiatives. Win together: We share context, assume good intentions, and value collective success over individual heroics. Bring your whole self: We do serious work, but we also believe humor, curiosity, and enjoying the people you work with make the work better. Base Salary Range $89,000 — $105,000 USD About Us We live and breathe our company values: We are customer obsessed — We focus on delivering solutions to our customers that create value and make their lives better. We have a bias for intentional action — We prioritize, plan, try things, and fail fast. We don't take ourselves too seriously (but we do serious work) — We are solving an important problem which takes focus, but we also like to enjoy the journey. We trust each other and assume good intentions — We're transparent with decisions to empower team members to make well informed decisions. A few of the benefits we offer: Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. Our Approach to Equity: Receive stock options upon hire and promotion. Plus, you can participate in secondary offerings and have 10 years to exercise your options (yes, you read that correctly: 10 years!). 100% Covered Health Insurance: We cover 100% of your health, vision and dental insurance premiums for you and your dependents. Nothing comes out of your paycheck. ∞ Flexible Time Off: Take the time you need – to do our best work, we need to recharge and reset. 18 Weeks Paid Parental Leave: We offer 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year. If your experience is close but doesn't fulfill all requirements, please apply. We're building the best team in technology and are focused on hiring "Chainguardians" with unique backgrounds, perspectives, and experiences. Chainguard is an equal opportunity employer. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law. By submitting your application, you acknowledge that Chainguard will process your personal data in accordance with Chainguard's Global Candidate Privacy Notice . ©2026 Chainguard. All Rights Reserved.

Location: Remote, Global Workplace: Remote ABOUT THE ROLE We’re looking for a GRC Analyst to join our Compliance & Security team and help make risk management, audit and compliance a continuous part of how Supabase runs. You’ll work closely with engineering, security, IT, and legal to help us define our risk tolerance, keep our compliance programs (including SOC 2 and ISO/IEC 27001:2022) current, test controls on a rolling basis, and answer customer and vendor security reviews quickly and accurately. This role is ideal for someone who thrives in async, fast-paced environments and is excited about building developer tools that scale to millions. WHAT YOU’LL BE RESPONSIBLE FOR - Run risk assessments across the company and major product changes. Score likelihood and impact, propose treatments, and bring the results to leadership to inform risk tolerance decisions. - Maintain the risk register, track remediation to closure, and report status to compliance and security leadership. - Monitor controls on a rolling basis, using automated tests where they exist and manual testing where they don’t. Triage failures, prioritize by the risk register, and align each finding with an owner and a due date. - Support internal audit, whether performed by an external partner or in-house: propose scope from the risk register, supply evidence, and track findings to closure. - Run day-to-day operations for our compliance programs: evidence collection, control owner follow-up, and readiness ahead of each audit period. - Extend continuous control validation beyond what our compliance platform covers. Build custom tests with AI coding tools, work with engineering and IT to pull evidence from source systems instead of collecting screenshots, and check that each test proves what the control requires. YOU MIGHT BE A GOOD FIT IF YOU - Have 3+ years of experience in GRC, internal audit, or security compliance at a SaaS or technology company - Are comfortable working with SOC 2 and ISO 27001 controls, a compliance platform such as Drata, Vanta, and evidence from systems like AWS, GCP, Google Workspace, and Okta - Communicate clearly across both technical and non-technical audiences - Have experience in async or globally distributed teams - Are energized by solving real-world problems for developers - Are comfortable navigating ambiguity and moving quickly WHAT WE OFFER - Fully Remote We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world. - ESOP Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together. - Tech Allowance Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work. - Health Benefits Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us. - Annual Off-Sites Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year. - Flexible Work We operate asynchronously and trust you to manage your own time. You know what needs to be done and when. - Professional Development Every team member receives an annual education allowance to spend on learning—courses, books, conferences, or anything that supports your growth. ABOUT THE TEAM Supabase was born-remote and open-source-first. We believe our globally distributed team is our secret weapon in building tools developers love. - ~400 team members - 60+ countries - 20+ languages spoken - Over $1B raised (including our $500M Series F) - 540,000+ community members We move fast, build in public, and use what we ship. If it’s in your project, we probably use it in ours too. We believe deeply in the open-source ecosystem and strive to support—not replace—existing tools and communities.

Location: Anywhere in France Workplace: Hybrid HEALTH CAN’T WAIT. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture https://alan.com/en/careers. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. 🛡️ THE ROLE Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll own security governance and risk at Alan end to end. That means one clear framework across our certifications and regulations, which the whole company uses to decide what matters most. You set the direction, make the calls on risk, and help every team own its part. We just earned our HDS certification, and there's much more to build as we grow from 1M to many millions of members, across more countries and regulators. That includes how we govern AI, which Alan uses across its products and operations. This is a hands-on senior role. You do the work yourself, mentor the junior GRC engineer we're hiring alongside you, and grow the team over time.   🚀 WHAT YOU'LL DO - Make our security framework a tool for the whole company. You own the full certification cycle (ISO 27001, HDS and those to come), and turn it into something teams use every day to prioritise, not a binder for auditors. - Bring the security view on regulation. Legal and Risk own the regulatory relationships. You bring the security answer: what the rules mean for how we protect data, and which controls make it work in practice. - Run risk as an ongoing programme. You map and prioritise security risks, including AI risks, turn them into clear treatment plans, and feed them into company-wide risk decisions with the Risk team. - Help every team own its risks. You define the controls framework and the standards, while the teams who build and run our systems own the controls. You brief the board and audit committee, and you know which findings need an urgent call and which can wait for the quarterly report. - Own incident governance. You triage and escalate incidents, own business continuity and disaster recovery, and shape the security side of our regulatory incident reports. - Be a credible partner to engineering. You work with engineering teams early on new designs and spot control gaps (access, encryption, logging) before they ship. You don't need to be an architect, but you can hold the conversation.   🏗️ WHAT YOU'LL BUILD - One governance model: clear ownership of risks and controls across teams, so security decisions don't bottleneck on one person. - A living risk map: prioritised risks that actually drive company and engineering decisions. - One compliance backbone: a single control system across our countries and regulators, built to scale. - An automated evidence engine: evidence collected straight from engineering systems, so audits run continuously instead of as a quarterly rush. You'll work closely with Legal, the Data Protection Officer, Internal Audit and Risk, and day to day with engineering and operations teams.   ⭐ WHAT WE'RE LOOKING FOR Your team You'll join Alan's Corporate team, which brings together our control functions: Risk, Corporate Governance & Internal Control, Legal, Compliance and Security. They share one mission: building what lets Alan operate at scale, safely and responsibly. Within that group, you carry the security governance and risk dimension, working hand in hand with the security engineers who run our infrastructure and platform security, and with a junior GRC engineer we're hiring alongside you. You'll be hands-on every day, building and owning the work yourself. Along the way, you'll mentor the junior engineer and help shape how GRC grows at Alan. What you bring - You want to build and own things yourself, and you enjoy helping someone else grow while you do it. - 6+ years in security, with real GRC ownership. - You've run a GRC roadmap in a certified or strongly regulated environment (ISO 27001, HDS, SOC 2, or regulated sectors like health, insurance or finance). You're comfortable working with certification auditors, and you can explain what a framework requires and why it makes sense for business teams. - You take a stand on risks, and you'd rather close one real risk than write ten policies. - You're fluent in French and English.   A big plus - You've driven a certification or audit cycle end to end yourself. - You've automated compliance work, or you're eager to, and you have a view on where AI can help. - You've presented risk to senior leaders or a board. - You've mentored or onboarded someone before. 🌍 HOW WE WORK Location: You must be legally eligible to work from France, Belgium or Spain. Remote work: We offer remote work flexibility. Contract type: Permanent contract only (no freelancing).   🎯 IMPORTANT NOTE: WE HIRE PEOPLE, NOT ROLES. If you're excited about this opportunity but don't check every box, we'd love to hear from you. Everyone, no matter how underrepresented, should feel free to apply, as it can only bring learnings or success. Remember, this is just a guide, not a checklist. We'll be thrilled to receive your application!   🔖 Check out our About Alan https://alan.com/about and Career https://alan.com/careers pages, as well as our Medium https://medium.com/alan, blog https://blog.alan.com/ and Glassdoor page https://www.glassdoor.com/Overview/Working-at-Alan-EI_IE1696043.11,15.htm for more info.   YOU WANT TO KNOW MORE ABOUT ALAN?   🙌 Perks & Benefits https://alan.com/en/careers/a/salary-equity: Alaners are provided with a stimulating environment and perks ensuring they are happy, efficient and spend only high-quality time with co-workers. 🤘A strong culture https://alan.com/en/about/a/leadership-principles: People joining Alan are often surprised and delighted by our innovative working method. We have a set of cultural values that guide our approach to work

Location: Anywhere in France Workplace: Hybrid HEALTH CAN’T WAIT. Not for symptoms to get worse. Not for a six‑month appointment. Not for a system to catch up. But that’s exactly how healthcare works today. You wait, until you can’t. Alan exists to end the wait. Health is a universal right, and we believe this right can only become real when it’s coupled with prevention. We need to stop treating health as something we repair and start treating it as something we build, every day. It’s not solely a question of willpower. It’s the healthcare system itself that needs to work for everyone, in a sustainable way. So we are building the new standard in prevention insurance. Alan is the first company that integrates insurance, prevention, and care into a single, acclaimed user experience. We are on an incredible journey to build a global leading company, with a unique culture https://alan.com/en/careers. We already partner with 40K+ companies of all sizes, serving more than 1M+ members, and have reached €800M+ in ARR. Prevention as the new norm. That's what we're building with our team of 1000+ people. If it speaks to you: we're hiring across France, Spain, Belgium, and Canada. And beyond. 🛡️ THE ROLE Most GRC roles are about keeping auditors happy. This one is about earning our members' trust: every day, they share their diagnoses, their claims and their care with us. You'll join Alan's security team to help run our compliance and risk work across ISO 27001, HDS and DORA, across a growing number of countries and regulators. We just earned our HDS certification, and there's much more to build, including how we govern AI across our products: assessing AI risks, setting the controls, and keeping up with the AI Act. You'll learn alongside experienced security engineers, with a dedicated coach from day one. You'll take on real ownership early, and your scope grows as we scale from 1M to many millions of members. And you'll learn how we work at Alan: teams own their risks and controls, we automate wherever we can, and we focus on real outcomes, not paperwork. 🚀 WHAT YOU'LL DO - Keep our certifications on track. You run the day-to-day of the ISO 27001 and HDS audit cycles: collecting evidence, preparing internal audits, and following up on corrective actions until they're closed. - Turn regulations into practical actions. With Legal and the DPO, you help translate requirements like DORA, HDS, and GDPR into clear tasks for the teams, and track that they get done. - Learn the health sector rules. You build your knowledge of health-specific frameworks (ANS, HDS) and help apply them to how we handle health data. - Contribute to risk management. You help build and update our risk mapping, including AI risks, and follow up on the treatment plans with the teams who own them. - Support the teams who own the controls. You keep the controls framework up to date, answer teams' questions, and help explain security clearly to every stakeholder, from engineers to managers. - Support incident governance. You help classify and document incidents, keep Business continuity and Disaster recovery plans up to date, and prepare inputs for DORA incident reports. - Automate what slows us down. You spot repetitive compliance tasks and automate them with scripts, tools or AI. 🏗️ WHAT YOU'LL HELP BUILD - One compliance backbone: A single control system for several regulators in several countries, so Alan can scale without rebuilding compliance each time. - An automated evidence engine: evidence collected straight from engineering systems with scripts and AI, so audits run continuously instead of as a quarterly rush. You'll work closely with Legal, the DPO, Internal Audit and Risk, and day to day with engineering and operations teams. ⭐ WHAT WE'RE LOOKING FOR - You want to do the work yourself and grow with it: a permanent, hands-on role where you build things for the long run. - 2+ years in security, GRC or compliance (an audit background is fine if you want to move into building). - You've played a key part in a certification or audit cycle (ISO 27001, HDS, SOC 2 or similar). - You're curious about how things work technically, and you've automated at least one manual task (a script, a tool, an AI workflow). - You're fluent in French and English, and comfortable presenting in both. - You learn fast, ask for feedback, and go into the details when it matters. 🌍 HOW WE WORK Location: You must be legally eligible to work from France, Belgium or Spain. Remote work: We offer remote work flexibility. Contract type: Permanent contract only (no freelancing). 🎯 IMPORTANT NOTE: WE HIRE PEOPLE, NOT ROLES. If you're excited about this opportunity but don't check every box, we'd love to hear from you. Everyone, no matter how underrepresented, should feel free to apply, as it can only bring learnings or success. 🔖 Check out our About Alan https://alan.com/about and Career https://alan.com/careers pages, as well as our Medium https://medium.com/alan, blog https://blog.alan.com/ and Glassdoor page https://www.glassdoor.com/Overview/Working-at-Alan-EI_IE1696043.11,15.htm for more info. YOU WANT TO KNOW MORE ABOUT ALAN? 🙌 Perks & Benefits https://alan.com/en/careers/a/salary-equity: Alaners are provided with a stimulating environment and perks ensuring they are happy, efficient and spend only high-quality time with co-workers. 🤘A strong culture https://alan.com/en/about/a/leadership-principles: People joining Alan are often surprised and delighted by our innovative working method. We have a set of cultural values that guide our approach to work

Location: Remote We are the creators of a new fintech era! Our mission is to change this world by making blockchain accessible to everyone in everyday life. WhiteBIT is a global team of over 1,200 professionals united by one mission — to shape the new world order in the Web3 era. Each of our employees is fully engaged in this transformative journey. We work on our blockchain platform, providing maximum transparency and security for more than 8 million users worldwide. Our breakthrough solutions, incredible speed of adaptation to market challenges, and technological superiority are the strengths that take us beyond ordinary companies. Our official partners include the National Football Team of Ukraine, FC Barcelona, Lifecell, FACEIT and VISA. The future of Web3 starts with you: Requirements 4–6+ years of experience in Information Security, GRC, Risk Management, Compliance, IT Audit, or a related field. Strong practical knowledge of information security and compliance frameworks such as ISO 27001, SOC 2, PCI DSS, CCSS or similar. Experience working with applicable regulatory requirements such as NIS2, DORA, GDPR, or other relevant regulations. Hands-on experience conducting information security risk assessments, control assessments, gap analyses, and compliance reviews. Experience supporting or coordinating internal and external audits, certifications, and regulatory assessments. Ability to independently manage compliance initiatives, track remediation activities, and follow up with control owners. Experience developing, reviewing, and maintaining security policies, standards, procedures, controls, and related documentation. Understanding of common information security domains, including access management, vulnerability management, incident management, third-party risk, business continuity, cloud security, and data protection. Experience working with third-party/vendor risk assessments and security due diligence. Experience responding to customer security questionnaires, RFIs/RFPs, or customer compliance requests. Ability to translate regulatory, contractual, and security requirements into clear and actionable controls for technical and business teams. Strong stakeholder management skills and experience collaborating with Security, IT, Engineering, Legal, Privacy, Procurement, and business teams. Strong analytical skills and ability to identify, assess, document, and communicate security and compliance risks. Excellent written and verbal communication skills, including the ability to explain GRC topics to both technical and non-technical stakeholders. Strong organizational skills and ability to manage several compliance, risk, and audit activities in parallel. Ability to work independently, prioritize effectively, and take ownership of GRC activities from identification through remediation and closure. Professional working proficiency in English. Nice to have: Experience in SaaS, cloud-based, technology, or other highly regulated environments. Experience with GRC platforms or compliance automation tools such as ServiceNow GRC, OneTrust, Vanta, Drata, AuditBoard, or similar. Familiarity with cloud platforms such as AWS, Azure, or GCP from a governance and compliance perspective. Relevant professional certifications such as CISA, CISM, CRISC, CISSP, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor. Experience participating in or leading compliance improvement and control maturity initiatives. Responsibilities Own and coordinate day-to-day GRC activities across information security, risk management, compliance, and assurance. Conduct information security risk assessments, identify control gaps, document risks, and track remediation actions with relevant owners. Support the implementation, maintenance, and continuous improvement of security and compliance frameworks such as ISO 27001, SOC 2, PCI DSS, and other applicable standards. Monitor relevant regulatory and contractual requirements and help translate them into practical security controls and compliance activities. Coordinate and support internal and external audits, certification activities, customer assessments, and regulatory reviews. Maintain and improve security policies, standards, procedures, control documentation, risk registers, and other GRC documentation. Perform control assessments and periodically evaluate the effectiveness of implemented security controls. Track audit findings, compliance gaps, risks, and remediation plans through to closure. Support third-party and vendor security risk assessments, including due diligence and ongoing risk reviews. Manage and respond to customer security questionnaires, security reviews, and compliance-related requests in collaboration with relevant teams. Partner with Security, IT, Engineering, Legal, Privacy, Procurement, and business stakeholders to ensure security and compliance requirements are understood and implemented. Provide guidance to control owners on compliance requirements, risk treatment, evidence collection, and remediation activities. Identify opportunities to improve and automate GRC processes, evidence collection, reporting, and compliance monitoring. Develop and maintain GRC metrics, dashboards, and reporting to provide visibility into risks, compliance status, audit findings, and remediation progress. Support security awareness and compliance initiatives where relevant. Stay informed about changes in security standards, regulations, and industry practices and assess their potential impact on the organization. Working terms Immerse yourself in Crypto & Web3: Master cutting-edge technologies and become an expert in the most innovative industry. Work with the Fintech of the Future: Develop your skills in digital finance and shape the global market. Take Your Professionalism to the Next Level: Gain unique experience and be part of global transformations. Drive Innovations: Influence the industry and contribute to groundbreaking solutions. Join a Strong Team: Collaborate with top experts worldwide and grow alongside the best. Work-Life Balance & Well-being: Modern equipment. Comfortable working conditions, and an inspiring environment to help you thrive. 24 calendar days of paid leave. Additional days off for national holidays. With us, you’ll dive into the world of unique blockchain technologies, reshape the crypto landscape, and become an innovator in your field. If you’re ready to take on challenges and join our dynamic team, apply now and start a new chapter in your career! Let’s Build the Future Together! WhiteBIT offers all candidates an equal opportunity to join the team. All hiring decisions are made without regard to race, national origin, gender identity or sexual orientation, age, religion, disability, medical condition, marital status, familial status, veteran status, or any other legally protected characteristic of an individual. Your privacy matters to us. You can learn more about how we handle your personal data with regard to your application in our Candidate Privacy Notice .

Location: San Francisco, CA | Seattle, WA | New York City, NY | Washington, DC About Anthropic Anthropic’s mission is to create reliable, interpretable, and steerable AI systems. We want AI to be safe and beneficial for our users and for society as a whole. Our team is a quickly growing group of committed researchers, engineers, policy experts, and business leaders working together to build beneficial AI systems. About the team Anthropic's Security Governance, Risk, and Compliance (GRC) team is the connective tissue that holds the company accountable to its security commitments. We translate regulatory, customer, and voluntary obligations into controls that teams act on, and give leadership a bird's-eye view of how well we're meeting them. We're building toward a fundamentally different kind of GRC: one that directs Claude, with the right humans in the loop, to challenge and evidence the performance of controls continuously rather than through periodic audits. Within Security GRC, Audit & Assurance runs the integrated audit across our frameworks and maintains the Common Control Framework the program hangs off. This role sits in Audit & Assurance and helps run that integrated audit program, plan the audits we add next, and assess the frameworks and scope changes we are considering. About the role You'll help run Anthropic's unified audit program: quarterly audits across SOC 2, HIPAA and the ISO 27000 family including ISO 42001, plus the rest of our certifications, working with our audit firms, our GRC Partners, and control owners across the company. You'll plan new audits as we expand to new frameworks, platforms and regions, and run the gap assessments that tell us what each expansion takes before we commit to it. You'll help build the audit operating model and runbook, and drive automation in the program so evidence is collected once and reused across frameworks, requests reach control owners once, and each audit cycle takes less effort than the last. Building with Claude is a normal part of the job, with you deciding where human judgment stays in the loop. This is an individual contributor role for someone with program management experience who writes clearly, stays calm under deadlines, and likes making a busy program simpler. Key responsibilities Run the audit program as a program: one integrated plan and calendar across audits and expansions, with milestones, dependencies, risks and decisions tracked, and regular status to GRC leadership and stakeholders Plan and run the quarterly audits, from scoping through report and findings closeout Run audit readiness ahead of each fieldwork window: control owner prep, evidence pre-checks and walkthrough dry runs Scope each audit's boundary with Product and Engineering: which products and deployment paths are in scope, and flag when a launch or new platform changes it Help build the audit operating model and runbook for a unified audit program, and keep both current as the program grows Drive automation in the program: evidence collected from source systems, request tracking and audit reporting, with evidence and walkthroughs reused across frameworks Coordinate audits across frameworks and firms so audit windows line up and control owners are asked for the same evidence once, and drive new ways of automated evidence generation and collection with GRC Engineering Plan new audits and audit expansions as we commit to them Run framework and scope expansion evaluations and gap assessments, with a recommendation and an effort estimate leadership can act on Work closely with control owners and GRC Partners: prepare control owners for audits, get evidence delivered and findings closed, and hand findings that need extended remediation to GRC Partners Manage day-to-day auditor relationships, and report audit status, findings and program metrics to GRC leadership Minimum qualifications Several years of program management: running multi-workstream programs with a plan, milestones, dependencies, risk tracking and status reporting to leadership Several years running external security audits (SOC 2 and ISO 27001 at minimum), on the company side or at an audit firm, including seasons with several frameworks at once Working knowledge of SOC 2, the ISO 27000 family, ISO 42001 and HIPAA, and where their requirements overlap Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership Experience building or improving an audit process: calendars, request tracking, runbooks, roles and responsibilities Enough technical fluency to understand how evidence is produced in cloud environments and to judge whether a system-generated report is complete and accurate, and to build simple automations with Claude Clear writing and calm coordination under deadline pressure Ability to get control owners to deliver on time without authority over them Preferred qualifications Audit firm experience (Big 4 or a SOC 2 or ISO certification body), especially as a senior or manager on technology clients Experience adding new frameworks such as PCI DSS, ISO 27701 or 27018, CSA STAR, or international schemes (for example IRAP, ISMAP or C5) Have automated evidence collection or audit reporting, or use Claude or other LLMs day to day to plan, track and report program work Experience with a GRC platform or building lightweight internal tooling You don't need to Have done everything on this list. The combination is running a global audit calendar well, plus the instinct to make it simpler each cycle Hold every certification. CISA, CISSP, ISO 27001 Lead Auditor or similar are welcome but not required Have prior AI industry experience Deadline to apply: None. Applications will be received on a rolling basis. The annual compensation range for this role is listed below. For sales roles, the range provided is the role’s On Target Earnings ("OTE") range, meaning that the range includes both the sales commissions/sales bonuses target and annual base salary for the role. Annual Salary: $255,000 — $270,000 USD Logistics Minimum education: Bachelor’s degree or an equivalent combination of education, training, and/or experience Required field of study: A field relevant to the role as demonstrated through coursework, training, or professional experience Minimum years of experience: Years of experience required will correlate with the internal job level requirements for the position Location-based hybrid policy: Currently, we expect all staff to be in one of our offices at least 25% of the time. However, some roles may require more time in our offices. Visa sponsorship: We do sponsor visas! However, we aren't able to successfully sponsor visas for every role and every candidate. But if we make you an offer, we will make every reasonable effort to get you a visa, and we retain an immigration lawyer to help with this. For roles performing work in California: We will consider for employment all qualified applicants, including those with arrest or conviction records or criminal histories, in a manner consistent with the requirements of applicable state and local laws, including the San Francisco Fair Chance Ordinance, the City of Los Angeles’ Fair Chance Initiative for Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act. We encourage you to apply even if you do not believe you meet every single qualification. Not all strong candidates will meet every single qualification as listed.  Research shows that people who identify as being from underrepresented groups are more prone to experiencing imposter syndrome and doubting the strength of their candidacy, so we urge you not to exclude yourself prematurely and to submit an application if you're interested in this work. We think AI systems like the ones we're building have enormous social and ethical implications. We think this makes representation even more important, and we strive to include a range of diverse perspectives on our team. Your safety matters to us. To protect yourself from potential scams, remember that Anthropic recruiters only contact you from @anthropic.com email addresses. In some cases, we may partner with vetted recruiting agencies who will identify themselves as working on behalf of Anthropic. Be cautious of emails from other domains. Legitimate Anthropic recruiters will never ask for money, fees, or banking information before your first day. If you're ever unsure about a communication, don't click any links—visit anthropic.com/careers directly for confirmed position openings. How we're different We believe that the highest-impact AI research will be big science. At Anthropic we work as a single cohesive team on just a few large-scale research efforts. And we value impact — advancing our long-term goals of steerable, trustworthy AI — rather than work on smaller and more specific puzzles. We view AI research as an empirical science, which has as much in common with physics and biology as with traditional efforts in computer science. We're an extremely collaborative group, and we host frequent research discussions to ensure that we are pursuing the highest-impact work at any given time. As such, we greatly value communication skills. The easiest way to understand our research directions is to read our recent research. This research continues many of the directions our team worked on prior to Anthropic, including: GPT-3, Circuit-Based Interpretability, Multimodal Neurons, Scaling Laws, AI & Compute, Concrete Problems in AI Safety, and Learning from Human Preferences. Come work with us! Anthropic is a public benefit corporation headquartered in San Francisco. We offer competitive compensation and benefits, optional equity donation matching, generous vacation and parental leave, flexible working hours, and a lovely office space in which to collaborate with colleagues. Guidance on Candidates' AI Usage: Learn about our policy for using AI in our application process.

Задачи: — Автоматизация сбора доказательств. — Настройка и эксплуатация платформы автоматизации GRC: подключение источников данных, создание плагинов для доказательств, определение наборов данных, написание правил анализа и организация непрерывного мониторинга, замена ручных процессов скриншотов на автоматизированные сборщики, сопоставленные с контролями. — Автоматизация рабочих процессов GRC и выполнение compliance как кода. — Использование Claude Code (или аналогов) и MCP для запросов доказательств, сопоставления контролей, анализа пробелов, обзоров поставщиков и отчетности. — Создание и поддержка агентских систем команды. — Управление политиками, определениями контролей и автоматизацией в GitHub через ветки, pull-запросы и ревью. — Проектирование тестирования контролей и управление исправлениями. — Инструментирование тестирования по стандартам SOC 2, ISO 27001, ISO 27017/27018, ISO 27701, PCI DSS и ISO 42001 для непрерывного обеспечения, а не точечных снимков, и работа с владельцами контролей и инженерами для устранения пробелов с автоматизированными доказательствами. Требования: — Опыт 5+ лет в области compliance, GRC или IT-аудита, практический опыт с SOC 2, ISO 27001, PCI DSS и смежными стандартами. — Опыт 1+ года использования агентских AI-систем (Claude Code, Codex и др.) для реальной работы по compliance с реализованной автоматизацией. — Уверенное владение GitHub: репозитории, ветки, pull-запросы и код-ревью. — Знание CI/CD будет преимуществом. — Быстрая обучаемость новым инструментам. — Способность самостоятельно настраивать платформу автоматизации GRC. — Глубокое понимание GRC: проектирование контролей, доказательства, риски и мышление аудиторов. — Знание облачных технологий (AWS, Azure, GCP): IAM, вычисления, хранение, сеть и контролей безопасности. — Системное мышление и предпочтение автоматизации повторяющейся ручной работы. Преимущества: — Умение читать API, JSON и логи. — Навыки скриптинга (Python, bash, TypeScript). — Опыт работы с платформами автоматизации GRC (Vanta, Drata или аналогичными). — Опыт интеграции через API и легкое программирование. — Сертификаты CISA, CISSP, ISO 27001 Lead Auditor или аналогичные. — Опыт в области управления рисками AI, AI governance или ISO 42001. — Опыт работы в технологической, SaaS или инженерной среде. Условия: — Полная занятость, гибридный формат работы, офис в Берлине. — Зарплата от 76 000 до 106 000 евро в год. — Помощь с релокацией в Германию: поддержка с визой, сервисы по месту назначения, бонус на покрытие расходов (временное жилье и др.). — Профессиональный и личный рост: обучение, коучинг, регулярная обратная связь. — Комплексные льготы для сотрудников в Германии: конкурентная оплата, медицинское обслуживание (включая психическое здоровье), страхование рисков, оплачиваемый отпуск. — Поддержка обустройства домашнего офиса, стипендии на здоровье и уход за питомцами, возможности для обучения и развития.

Dave is looking for a Lead GRC and Security Governance to build and operate technology risk, control, assurance, audit, incident, and business-continuity governance systems.

Location: San Francisco; Remote; Toronto; New York; Montreal; Seattle Workplace: Hybrid ABOUT BASETEN Baseten powers mission-critical inference for the world's most dynamic AI companies, like Cursor, Notion, OpenEvidence, Abridge, Clay, Gamma, and Writer. By uniting applied AI research, flexible infrastructure, and seamless developer tooling, we enable companies operating at the frontier of AI to bring cutting-edge models into production. We're growing quickly and recently raised our $1.5B Series F https://www.baseten.co/blog/announcing-our-series-f/, led by Altimeter Capital, Conviction Partners, and Spark Capital. Join us and help build the platform engineers turn to ship AI products. THE ROLE We are seeking an experienced and detail-oriented GRC (Governance, Risk, and Compliance) Manager to build, support, and continuously enhance Baseten’s security governance, compliance, and privacy programs. As one of the early members of our security organization, you will play a key role in ensuring our platform meets and exceeds the highest standards for privacy, trust, and regulatory compliance. You’ll work closely with Engineering, Product, Security, and Legal to define compliance requirements, assess platform capabilities, and drive implementation from initial scoping through validation. You will also lead customer assurance efforts, helping customers understand our security architecture and compliance posture while bringing their requirements back into product planning. Alongside this product focus, you’ll contribute to Baseten’s broader GRC program, including governance, risk management, audits, vendor assessments, and security awareness. RESPONSIBILITIES - Product Compliance: Translate regulatory, framework, and customer requirements into clear product requirements and technical controls, partnering with Engineering and Product to build compliance into platform design and development. - Governance & Policy Development: Design, implement, and maintain security governance frameworks, policies, and procedures that align with Baseten’s risk posture and industry best practices. - Risk Management: Build and manage the company-wide risk assessment program, identifying, tracking, and mitigating key security and compliance risks. - Compliance Operations: Support efforts to achieve and maintain compliance with SOC 2, ISO 27001/27701, HIPAA, FedRAMP and other applicable standards and regulations. - Audit & Certification Management: Coordinate external audits and certification processes, ensuring evidence collection, control validation, and remediation plans are executed efficiently. - Third-Party Risk Management: Oversee vendor security assessments and ensure third-party providers meet Baseten’s security and compliance standards. - Cross-Functional Collaboration: Partner with Engineering, Product, and Operations teams to embed compliance and risk management into day-to-day operations and technical processes. - Customer Trust & Assurance: Support customer security questionnaires, due diligence efforts, and documentation requests from prospective and existing clients. - Training & Awareness: Develop and deliver security and compliance training to ensure company-wide understanding of key policies and responsibilities. - Continuous Improvement: Stay current on evolving regulatory requirements and lead initiatives to mature our compliance and risk management programs. REQUIREMENTS - BS Degree in CS, CE, MIS or equivalent field - 5+ years of experience in GRC, Security Compliance, or Information Security roles, ideally in a SaaS or cloud-native environment. - Strong understanding of security frameworks and standards such as SOC 2, ISO 27001, NIST, and GDPR. - Proven track record managing compliance audits and certification programs end-to-end. - Experience working directly with leaders and executives within Enterprise organizations - Experience working cross-functionally with technical and non-technical stakeholders to implement compliance and security controls. - Proven experience driving product compliance by translating regulatory and customer requirements into actionable product controls with Engineering and Product - Experience defining project requirements and driving implementation by translating compliance objectives into clear deliverables, coordinating cross-functional stakeholders, and managing execution through completion. - Experience responding to customer security questionnaires and leading customer security interviews, with the ability to clearly communicate security controls, compliance posture, and risk management practices to technical and nontechnical audiences. - Ability to thrive in a fast-paced, high-growth startup environment while maintaining structure and process discipline. NICE TO HAVE - Experience with cloud security compliance in AWS or GCP environments. - Hands-on experience using GRC tools (e.g., Vanta, Drata, Secureframe, Anecdotes). - Understanding of AI/ML security considerations, data privacy, and model governance. - Previous experience building and implementing security controls in an early-stage or rapidly growing startup. - Relevant certifications (e.g., CISA, CISSP, CISM, ISO 27001 Lead Implementer). BENEFITS - Competitive compensation, including meaningful equity - (U.S. only) 100% coverage of medical, dental, and vision insurance for employee and dependents - Flexible PTO policy including company wide Winter Break (our offices are closed from Christmas Eve to New Year's Day!) - Paid parental leave - Fertility and family-building stipend through Carrot - (U.S. only) Company-facilitated 401(k) - Exposure to a variety of ML startups, offering unparalleled learning and networking opportunities. Apply now to embark on a rewarding journey in shaping the future of AI! If you are a motivated individual with a passion for machine learning and a desire to be part of a collaborative and forward-thinking team, we would love to hear from you. At Baseten, we are committed to fostering a diverse and inclusive workplace. We provide equal employment opportunities to all employees and applicants without regard to race, color, religion, gender, sexual orientation, gender identity or expression, national origin, age, genetic information, disability, or veteran status. We are an Equal Opportunity Employer and will consider qualified applicants with criminal histories in a manner consistent with applicable law (by example, the requirements of the San Francisco Fair Chance Ordinance, where applicable).

Location: Remote What you’ll be part of Garner is on a mission to transform the U.S. healthcare system — and we’re the only proven player doing exactly that. We partner with employers to redesign how healthcare works: applying 550+ proprietary clinical metrics across 80+ specialties to a dataset of 320M+ patients to identify the best-performing doctors, then using compelling incentives to steer members to the care that helps them get healthier, faster. The result is a rare “win win” — better care and lower costs for both members and employers. In just five years, our work has helped over 2.5 million people access higher-quality care and saved $1B in healthcare costs. We recently raised our Series E and have doubled five years running. If you've ever wanted your work to solve a problem that touches every person in this country, this is the opportunity to do exactly that. You'd be joining a team fundamentally reimagining healthcare in the U.S. — and using AI to scale that impact further and faster than anyone else can. About the role: We are looking for a Senior GRC Analyst to join our Technical Compliance team to ensure Garner’s compliance posture across security frameworks such as ISO 27001, SOC 2, HITRUST, and HIPAA. As a Senior GRC Analyst you will run our internal audits, guide our external assessments, and partner with teams across Engineering, Product, People, and Legal so that our controls are designed well, operating effectively, and continuously improving. Our Technical Compliance team safeguards Garner’s sensitive healthcare data and protects the trust of our members, clients, and partners by maintaining a strong control environment and regulatory compliance. The work you do here has a direct impact on our ability to win and retain enterprise customers, expand into new lines of business, and scale securely as we grow. Where you will work: This role is open to remote candidates across the U.S. For candidates based in New York City, the position follows a hybrid schedule with in-office work required Tuesday, Wednesday, and Thursday each week. What you will do: Manage and support our compliance certifications, including SOC 2, HITRUST, and ISO 27001 audits and run control testing across the audit lifecycle Serve as the subject matter expert across the company on our compliance frameworks Serve as the primary point of contact for external auditors and assessors Manage Garner’s Security and Privacy trust center Maintain the risk register and drive risk identification, scoring, and reporting Manage the maintenance of our compliance policies, standards, and procedures Report on our compliance posture to senior leadership Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest What you will bring to the team: 5+ years of experience in GRC, IT audit, or information security compliance Prior experience with HITRUST, SOC 2, and ISO 27001 audits Hands-on experience with control design, evidence collection, and remediation in a cloud-native engineering environment Proven ability to adapt your communication style across engineers, operators, and executives A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks A desire to be a part of a high-performing, mission-driven team that operates with intense urgency, a strong sense of individual accountability, and a commitment to authentic feedback Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred Technologies we use: AWS, Okta, Datadog, Retool, Gitlab, Vanta, Claude Please note: we are unable to sponsor or take over sponsorship of an employment visa at this time. Compensation Transparency: The target salary range for this position is $155,000 - $185,000. Individual compensation for this role will depend on various factors, including qualifications, skills, and applicable laws. In addition to base compensation, this role is eligible to participate in our equity incentive and competitive benefits plans, including but not limited to: flexible PTO, Medical/Dental/Vision plan options, 401(k), Teladoc Health and more. Fraud and Security Notice: Please be aware of recent job scam attempts. Our recruiters use getgarner.com and garnerhealth.com email domains exclusively. If you have been contacted by someone claiming to be a Garner recruiter or a hiring manager from a different domain about a potential job, please report it to law enforcement here and to candidateprotection@garnerhealth.com . Equal Employment Opportunity: Garner Health is proud to be an Equal Employment Opportunity employer and values diversity in the workplace. We do not discriminate based upon race, religion, color, national origin, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, genetic information, political views or activity, or other applicable legally protected characteristics. Garner Health is committed to providing accommodations for qualified individuals with disabilities in our recruiting process. If you need assistance or an accommodation due to a disability, you may contact us at talent@garnerhealth.com .