Security GRC Lead
Mercor, San Francisco
The role
You'll be the first GRC hire at a company that processes some of the most sensitive data on earth: training data, evals, and human-feedback pipelines for the frontier AI labs, plus payments and KYC for 300K+ experts.
This is not an audit-theater role. You'll own the operating cadence of a continuously-audited company: continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA. You'll write controls in code where it makes sense, push back on tools that fight you, and own the artifacts that close enterprise deals.
We use AI heavily in our own GRC work. You should be comfortable using LLMs to draft, review, and respond at speed. If you've ever copy-pasted the same answer into 14 vendor questionnaires by hand, you'll appreciate not having to.