Search Jobs
Apply Now

Gusto is seeking a Security, Governance, Risk & Compliance professional to join its team managing security governance, risk and compliance initiatives.

This person will guide the company from foundational Governance, Risk & Compliance (GRC) maturity through to steady-state operations, leveraging AI to automate and improve old practices and tools, ensuring ongoing compliance with SOC 2 Type 2, IT General Controls, ICOC and related frameworks, while embedding security-minded practices throughout Gusto.

Responsibilities:

  • Develop, maintain, and ensure adherence to security and compliance SOPs, internal documentation, and company-wide policies,particularly supporting SOC 2 and future framework adoption.
  • Own and manage trust management platforms including documentation of controls, risks, vendors, and exceptions, and lead the implementation of AI agents to automate and improve the implementation of our controls framework and evidence collection to support it.
  • Collaborate with Legal, Enterprise Applications, and Gusto counterparts to establish and maintain data governance policies.
  • Conduct ongoing internal risk assessments to identify exposure and control gaps; coordinate remediation plans with functional teams.
  • Manage the third-party vendor risk program, including onboarding reviews, monitoring, and renewal assessments.
  • Lead interactions with external auditors and regulatory bodies during compliance assessments.
  • Stay current on relevant compliance frameworks, laws, and regulations to ensure appropriate coverage and adaptability.
  • Partner cross-functionally to implement scalable GRC processes, harmonize systems, and foster GRC understanding through employee enablement programs and KPI-driven insights.

Requirements:

  • 8+ years of experience in governance, risk, and compliance within SaaS, ideally in the HCM, payroll, or fintech sectors.
  • Bachelor’s degree in Business, Information Systems, or a related field.
  • Strong understanding of SaaS business models, with experience implementing controls and policies in fast-paced, product-driven environments.
  • Proven experience leading or supporting a SOC 2 Type 2 compliance initiative.
  • Familiarity with compliance tools and platforms such as Optro, Vanta, Drata, Viso Trust, or similar.
  • Demonstrated ability to translate complex GRC requirements into actionable, scalable processes.
  • Excellent written and verbal communication skills.
  • A data-informed mindset, with the ability to use analytics to assess GRC performance and maturity.
  • One or more relevant professional certifications: CISA, CRISC, or GRCP preferred.

Benefits:

  • Competitive base pay
  • Benefits
  • Equity (RSUs)

Salary: $183,000-205,000 per year

Similar jobs