Latest AI JobsBrowse Jobs
mercor logo

Security GRC Lead

mercorSan FranciscoSecurity
Apply on company site
Salary
$350K – $425K
Job type
Full-time
Experience
Lead · 7+ yrs
Posted
9 Sept 2026
Status
Open · checked 7d ago

About this role

Based in San Francisco, this full-time role is for the first Security GRC Lead at Mercor and suits an experienced compliance professional ready to build and run the governance framework from the ground up. The position requires working in person five days a week at the San Francisco headquarters.

Role Overview

Mercor seeks its first Security GRC Lead to establish and manage the continuous compliance operating cadence for infrastructure handling sensitive training data and expert payments. This position focuses on driving ongoing security frameworks, managing customer audits, and supporting enterprise deal velocity through direct compliance ownership.

Key Responsibilities

Build and manage the compliance operating cadence covering continuous SOC 2 Type 2, ISO 27001 buildout, and additional regulatory frameworks like HIPAA, FedRAMP Moderate, or EU AI Act conformity.
Run a customer-audit machine and maintain a rapid turnaround SLA for security questionnaires.
Establish a third-party risk program with formal intake, recurring reviews, and procurement integration.
Manage the complete policy lifecycle from versioning and attestations to exception handling.
Implement controls-as-code with automated evidence collection and rules tied to SOC 2 CC categories.
Handle data-deletion gaps, DSAR workflows, KMS scheduled destruction, and offboarding handlers.
Develop internal trust narratives, security one-pagers, and executive disclosure templates.

Requirements

Seven or more years of experience in security GRC, compliance engineering, or audit, with at least two years managing a SOC 2 Type 2 program end-to-end under enterprise customer audit.
Successfully shipped at least one ISO 27001 certification from kickoff to issued certificate with a real registrar.
Advanced administrative proficiency with platforms such as Vanta, Drata, Secureframe, or Sprinto, including connector configuration and custom test creation.
Ability to translate cloud security findings into auditor language and map them to appropriate controls.
Experience writing controls as code or querying evidence using Python, SQL, or shell scripting.
Direct experience handling customer-trust surfaces including SIG, CAIQ, custom enterprise questionnaires, and on-site auditor sessions.

Nice to Have

Background building or operating a GRC program inside an AI lab, machine learning platform, or company serving frontier labs.
Familiarity with AI-specific frameworks like NIST AI RMF, EU AI Act conformity, or ISO 42001.
Experience with FedRAMP Moderate, HIPAA, PCI DSS, or SOC 2 plus HITRUST dual scope.
Prior experience automating questionnaire responses using large language models.
Experience standing up a third-party risk program from zero.
Experience writing a public trust page.

Skills and Tools

Vanta
Drata
Secureframe
Sprinto
Python
SQL
Shell scripting
Wiz
Panther
IAM

Salary and Benefits

Salary range of $350K to $425K with equity offers
Bi-annual performance bonus structure
Generous equity grant vested over 4 years
Up to $15k relocation bonus
$10K housing bonus for living within 0.5 miles of the office
$1.5K monthly stipend for meals
Free Equinox membership
$200 monthly laundry reimbursement
$200 monthly personal wellness reimbursement
Health, dental, and vision insurance

About the Company

Mercor organizes human intelligence to power the AI economy by acting as a bridge between human expertise and frontier models. The profitable Series C company is valued at $10 billion and operates with teams working in person five days a week in San Francisco, New York City, or London.

How to Apply

Candidates should apply on the official company careers page.

Skills and tech stack

VantaDrataSecureframeSprintoPythonSQLWizPantherIAMLLMLLMs

Questions candidates ask

What is the work arrangement for this role?

This position requires working in person five days a week at the San Francisco headquarters, with first Fridays remote.

What level of experience is required for the Security GRC Lead?

Applicants must have 7+ years in security GRC, compliance engineering, or audit, including at least 2 years owning a SOC 2 Type 2 program end-to-end.

What tools and platforms are used in this role?

The role utilizes compliance platforms like Vanta, Drata, Secureframe, or Sprinto, alongside technical tools such as Python, SQL, Wiz, and Panther.

What are the compensation details provided in the posting?

The position offers a salary of $350K to $425K with offers of equity, bi-annual performance bonuses, and various stipends and benefits.

Do I need prior experience with ISO 27001?

Yes, candidates must have shipped at least one ISO 27001 certification from kickoff to issued certificate with a real registrar.

Ready to apply?

The application is on the official mercor careers page.

Apply on company site