GRC Program Manager in Sydney, Florida at Deputy
Explore Related Opportunities
Job Description
The Role
As the GRC Program Manager, you will be empowered with AI to be the sole custodian and operator of Deputy’s integrated governance program. This is a highly impactful, "hands-on" role that requires a unique blend of strategic framework design and tactical, daily execution.
Reporting to the Senior Director of Security, you will be a true GRC Swiss Army Knife—responsible for building, running, and maintaining our comprehensive programs across Security, Privacy, AI Governance, and Data Governance, while simultaneously executing core security certifications (ISO 27001, SOC2, PCI-DSS) and managing high-volume compliance workflows.
Program Execution & Framework Management (The Doing):
- AI , Security & Privacy Controls: Design, implement, and personally monitor the internal controls required to achieve and maintain the ISO 42001 (AI) and ISO 27001 certifications, as well as adherence to the NIST AI and Privacy Frameworks.
- Audit Execution: Act as the primary hands-on coordinator for all internal and external audits, including evidence collection, control testing, and remediation tracking.
- Daily Workflow Management: Own and execute the daily operational GRC pipeline, leveraging AI-driven automation tools to efficiently manage third-party vendor risk assessments and customer security questionnaires.
Active Stakeholder Integration & Policy:
- Proactive Engagement: Embed yourself directly into product and engineering lifecycles at the initiation phase. Attend project kick-offs, actively listen, and translate business targets into GRC requirements.
- Policy Creation & Maintenance: Author, update, and roll out company policies associated with data protection, privacy-by-design, and ethical AI utilization.
- Business Acumen: Align risk and compliance activities with Deputy's broader operational goals, ensuring GRC is an enabler of business growth rather than an isolated silo.
Risk & Trust Enablement:
- Risk Assessments: Perform comprehensive, cross-functional risk assessments on new systems, internal operations, and product features, providing actionable mitigation steps.
- Sales Enablement: Serve as the point of escalation for compliance-related customer security inquiries, maintaining standard response repositories to accelerate sales velocity.
- Experience: 5+ years of hands-on experience in GRC roles within a fast-paced SaaS environment, with a proven track record of executing audits and building compliance workflows from scratch.
- The "Swiss Army Knife" Mindset: Demonstrated ability to pivot seamlessly between high-level policy writing and granular evidence collection; comfortable operating as an individual contributor who owns both strategy and administrative execution.
- Framework Expertise: Strong working knowledge of ISO 27001, SOC2, PCI-DSS, and emerging international standards such as ISO 42001 (AI).
- Communication: Exceptional active listening and interpersonal skills, with a demonstrated ability to influence cross-functional decisions and "read the room" to adapt strategies to company priorities.
- Nice to have - Certifications: Advanced certifications reflecting both security and privacy execution are highly preferred (CISSP, CIPP/E, CIPM, CISA, CISM, or CRISC).