It governance, risk, and compliance (grc) manager

Lead end-to-end readiness, evidence collection, and auditor management for SOC 2 Type II, ISO/IEC 27001, and PCI DSS attestations. Complete complex security questionnaires (HECVAT, CAIQ, SIG, municipal risk assessments) for US and Canadian enterprise and public sector clients. Educate prospective client security and legal teams on our marketplace architecture, explaining our status as an independent Data Controller and clarifying data ownership boundaries. Ensure platform policies and data workflows comply with US federal/state privacy legislation (CCPA/CPRA, FERPA, COPPA) and Canadian federal/provincial laws (PIPEDA, Quebec Law 25, Alberta/BC PIPA). Build and maintain an internal repository of security responses, data flow diagrams, and 1-page trust summaries; partner directly with sales reps under NDA during active deal cycles. Administer continuous compliance platforms (e.g., Vanta, Drata, Secureframe) integrated with cloud infrastructure (Azure/GCP) to automate control monitoring. Draft, update, and enforce internal security and privacy policies while coordinating annual penetration tests, vulnerability management, and risk assessments.