Security GRC Lead

About Mercor Mercor’s mission is to organize human intelligence for the AI economy. We build the infrastructure that enables frontier AI labs and enterprises to train, evaluate, and improve AI on real-world professional work. More than five million experts have joined our network, and we pay out over $5 million daily for their knowledge and expertise. We built our training and evaluation infrastructure alongside the world’s leading AI labs. Now, we’re bringing those capabilities to enterprises across industries, enabling them to train, evaluate, and improve AI using their own expertise and standards. Our APEX benchmarks measure how AI performs on economically valuable work, while our enterprise evaluations and post-training capabilities turn those insights into measurable improvements across real-world workflows. Our work sits at the intersection of frontier AI, human expertise, and real-world application. We’re solving problems few companies have encountered, with the opportunity to influence what the world’s most advanced AI systems become capable of doing. We’re looking for people who bring different perspectives, take ownership, exercise sound judgment, and hold themselves to an exceptionally high standard. You’ll have the opportunity to do consequential work alongside talented colleagues who challenge one another, collaborate openly, and share a commitment to excellence. Mercor is profitable and recently raised a $750 million Series D at a $20 billion valuation. We work in person five days a week in San Francisco, New York, and London. Role Description You'll be the first GRC hire at a company that processes some of the most sensitive data on earth: training data, evals, and human-feedback pipelines for the frontier AI labs, plus payments and KYC for 300K+ experts. This is not an audit-theater role. You'll own the operating cadence of a continuously-audited company: continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA. You'll write controls in code where it makes sense, push back on tools that fight you, and own the artifacts that close enterprise deals. We use AI heavily in our own GRC work. You should be comfortable using LLMs to draft, review, and respond at speed. If you've ever copy-pasted the same answer into 14 vendor questionnaires by hand, you'll appreciate not having to. We're in-person five days a week at our SF headquarters, with first Fridays remote. What You'll Build The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act conformity - your call on sequencing) A customer-audit machine that responds tocustomers The third-party risk program - formal intake, recurring review cadence, evidence requirements - tied into procurement so vendors can't be onboarded around it Policy lifecycle owned end-to-end: version, attestation, exception handling, review cycle - not a SharePoint graveyard Controls-as-code where it makes sense: integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection Data-handling procedures: the customer-data-deletion gap, DSAR workflow, KMS scheduled destruction, offboarding handlers The internal trust narrative: customer trust pages, security one-pagers, executive-ready disclosure templates when something goes sideways What We're Looking For 7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under audit by enterprise customers You've shipped at least one ISO 27001 certification from kickoff to issued certificate, including Stage 1 and Stage 2 with a real registrar Fluent in Vanta (or Drata, Secureframe, Sprinto) at the integration and admin level, not just the reviewer UI - you've configured connectors, written custom tests, debugged broken evidence You translate cloud-security language to auditor language and back without losing precision - you can read a Wiz finding, a Panther rule, an IAM policy, and say what control it maps to You write controls as code or query evidence with SQL when the platform falls short - Python, SQL, or shell, whatever it takes You know the difference between "we don't have a control for that" and "we have a compensating control" and you don't fabricate the second one Direct experience with the customer-trust surface: SIG, CAIQ, custom enterprise questionnaires, on-site auditor sessions, disclosure letters under legal review Bonus Points Built or operated a GRC program inside an AI lab, ML platform, or company serving frontier labs as customers Familiar with AI-specific frameworks: NIST AI RMF, EU AI Act conformity, ISO 42001 Experience with FedRAMP Moderate, HIPAA, PCI DSS, or SOC 2 + HITRUST dual scope You've automated questionnaire response with an LLM and know where it works and where it fails Prior experience standing up a third-party risk program from zero - vendor intake, recurring review, contract teeth Written a public trust page that customers actually trust Why Mercor Build the function, don't inherit it. This is the first GRC seat. You set the operating cadence, pick the tools (we're already on Vanta), define the rituals. Compliance work that closes deals. Every audit you nail is a contract that signs. You'll see the revenue downstream of your work in the same week. AI-native GRC. You'll use frontier models daily - evidence review, questionnaire drafting, control mapping - and have engineering support to build whatever tooling the off-the-shelf platforms won't. Direct line to the auditor and the customer. No layers between you and the people who matter - the audit firm, the customer security team, our outside counsel. You own the relationship end-to-end. A real security org behind you. TachTech (cloud), Latacora (MDR), Mandiant (IR), HackerOne (BB) are already running. You're not building the security program from scratch - you're putting the governance and assurance layer on top of one that already ships. Benefits: Generous equity grant vested over 4 years Health, dental, and vision insurance 401(k) with company match Unlimited paid vacation and sick days Parental leave for birthing and non-birthing parents Free mental health services $200 monthly wellness reimbursement $1.5K monthly meal stipend $200 monthly laundry reimbursement Free Equinox membership Up to $15K relocation bonus Mercor is an Equal Opportunity Employer and is committed to providing equal opportunity to all employees and applicants. Mercor does not discriminate based on actual or perceived race, color, creed, religion, national origin, ancestry, citizenship status, age, sex or gender (including pregnancy, childbirth, related medical conditions and lactation), gender identity or gender expression, sexual orientation, marital status, military service and veteran status, disability, protected medical condition as defined by California or local law, genetic information, or any other characteristic protected by applicable federal, California, or local laws and ordinances. Further, Mercor prohibits discrimination, harassment, and retaliation based on any combination of protected characteristics. This Policy applies to all areas of employment, including recruitment, hiring, training, promotion, compensation, benefits, discipline, termination, and all other privileges, terms, and conditions of employment. This Policy and the law prohibit employment discrimination against any employee or applicant based on any legally protected status.