GRC Manager
G2 · Chicago, IL
About this role
## About G2 G2 is the world’s largest and most trusted software marketplace—helping businesses make better, faster decisions with trusted insights from real software users. G2 has joined forces with Capterra, SoftwareAdvice, and GetApp to create a centralized source of online data and software insights. ## About the Role: GRC Manager The Governance, Risk, and Compliance (GRC) Manager owns G2’s day-to-day security compliance and risk program. This is a senior individual-contributor role responsible for keeping customer trust commitments, audit obligations, and risk posture on track. ### Summary of Responsibilities - Run a high-volume GRC operation across security questionnaires, vendor risk reviews, policy governance, DSAR processing, audit management, and risk register maintenance - Prioritize competing demands, scale a growing workload, and represent G2 to customers, auditors, and executive stakeholders - Partner across Legal, Security Engineering, IT, Sales, and leadership to unblock deals, resolve audit findings, and get policies approved ### Detailed Responsibilities - **Security policy library:** Own and administer 35+ security policy documents; lead annual review cycles and manage approvals to prevent lapses - **Security questionnaires:** Lead responses from short-form intake to 100+ question enterprise reviews; maintain a security knowledge library - **Trust Center:** Own and manage G2’s public Trust Center as the front-line representative for security/compliance inquiries - **Vendor risk management:** Review AI-assisted vendor risk assessments, determine final risk levels, and drive remediation for high-risk findings - **DSAR:** Manage DSAR intake and fulfillment, ensuring requests are documented and resolved within regulatory timelines - **Contracts & addenda:** Support security addendum and contract redlines with Legal and counterparties through multiple negotiation rounds - **Enterprise risk registers:** Maintain and mature risk registers across business functions; drive treatment plans, control linkage, and quarterly reassessment - **SOC 2 / ISO 27001 audits:** Lead SOC 2 Type II and ISO 27001 audit cycles end-to-end (evidence collection, control testing, auditor point of contact) - **GRC tooling & vendors:** Manage GRC tooling and vendor ecosystem (compliance platforms, audit firms, privacy tooling), including renewals and budget oversight - **Executive reporting:** Build and deliver dashboards/reporting on program health, audit status, and risk posture - **Corrective action guidance:** Advise internal teams on corrective action effectiveness after findings, control gaps, or compliance incidents - **Process improvement:** Identify bottlenecks and build business cases for automation/process changes ## Qualifications - **7–10 years** progressive experience in IT Governance, Risk, and Compliance or information security, including direct ownership of a compliance program - Deep working knowledge of **SOC 2 Type II, ISO 27001, NIST CSF**, and common SaaS/cloud security & privacy frameworks (e.g., **PCI DSS, GDPR, CCPA**) - Hands-on experience with modern GRC/compliance automation platforms (e.g., **Vanta, Drata, OneTrust**, or similar) - Proven experience managing high-volume customer security questionnaires and knowledge-library programs - Experience running third-party/vendor risk management (risk scoring + remediation tracking) - Experience managing **DSAR** or other privacy request workflows within regulatory timelines -
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.