CloudZero - GRC Manager
Requirements
• Governance, Risk & Compliance • 5+ years of experience in governance, risk, and/or compliance roles, ideally within a SaaS or cloud technology company • Proven experience building or significantly maturing a GRC program, with direct, hands-on involvement in SOC 2 or similar certification audits • Working knowledge of established risk management frameworks such as COSO, ISO 31000, or NIST RMF • Solid understanding of GDPR, CCPA, and how data privacy obligations translate into practical controls and policies • Communication & Leadership • Strong communicator who can make risk and compliance topics accessible and actionable for technical teams, business partners, and senior leadership alike • Ability to drive initiatives from scoping through completion while keeping multiple workstreams moving in a fast-paced environment • A business-enabling mindset — you treat compliance as something that creates competitive advantage, not just something that checks boxes • Prior experience at a SaaS technology startup • Hands-on technical experience with GCP, AWS, or Azure from a security and compliance lens • Experience working with Vanta or Drata for continuous compliance monitoring and automation • Experience with security questionnaire automation tools such as Loopio, Iris, or similar solutions • Professional certifications such as CRISC, CISA, CISM, CISSP, or CIPP • Familiarity with security frameworks including NIST CSF, CIS Controls, or OWASP • Proven ability to partner cross-functionally across departments to drive compliance goals and outcomes • Curiosity and enthusiasm for leveraging AI tools (such as Claude, Claude Code, or similar) to work smarter, automate repetitive tasks, and continuously find new ways to drive efficiency across the GRC function
Responsibilities
• Design and Operate the GRC Framework • Design and operate a comprehensive GRC framework spanning governance structures, enterprise risk management, and compliance programs that grows alongside CloudZero’s business • Own audit and certification programs including SOC 2 and other relevant standards, coordinating across internal teams and third-party auditors to drive successful outcomes • Own the development, maintenance, and ongoing improvement of CloudZero’s security and privacy policies and procedures, ensuring they’re current, practical, and embedded into how teams actually operate • Lead regular enterprise risk assessments, maintain a living risk register, and create an environment where risk-informed decision-making happens at every level of the organization • Governance, Risk & Business Continuity • Serve as a key stakeholder in building CloudZero’s AI Governance & Strategic Risk strategy • Take full ownership of business continuity and disaster recovery programs, including program design, documentation, regular testing cycles, and tabletop exercises — ensuring operational preparedness when it matters most • Build and manage third-party risk management processes, including vendor due diligence, contract reviews, and ongoing monitoring throughout the vendor lifecycle • Track regulatory developments alongside the Legal team, ensuring CloudZero meets its obligations under GDPR, CCPA, and other applicable requirements • Manage the company’s security awareness training program and run internal audits to validate that controls are working as intended • Sales and Revenue Enablement • Own the security questionnaire and assessment process — including VSAs, SIGs, and custom customer requests — with a primary focus on building and scaling tooling and automation that makes high-quality responses fast and repeatable • Review and redline security and data privacy language in customer and prospect contracts, working closely with Legal to protect CloudZero’s interests while keeping deals on track • Build and maintain a library of pre-approved security responses, compliance artifacts, and contract language so the team isn’t starting from scratch on every deal • Actively identify and implement tooling to automate questionnaire responses and security review workflows, reducing manual effort and accelerating deal cycles without sacrificing quality • Maintain and continuously improve CloudZero’s trust center, ensuring prospective customers have ready access to up-to-date security and compliance documentation • Partner with Sales Engineering and Solutions teams to address security and compliance requirements early in the sales cycle, removing friction before it becomes a blocker
Benefits
• Base Salry $150K – $190K • Offers Equity • Upload your resume here to autofill key application fields. • Drop your resume here! • Parsing your resume. Autofilling key fields... • Current location (City, State/Province, Country). Please note that we can only hire residents of the US at this time. • only hire residents of the US at this time. • or drag and drop here • F-1 Student (only if on OPT/STEM OPT and work-authorized) • H-1B Temporary Worker • L-1 Intracompany Transferee • L-2 Dependent of Transferee • Not applicable (U.S. citizen or permanent resident; no sponsorship needed) • Other (includes O-1, E-3, Green Card, etc.) • TN (NAFTA/USMCA) • If a local CloudZero office is available to you, what is your preferred work model? • Hybrid (in-office + remote flexibility) • Open to either hybrid or fully remote, no preference • Prefer fully remote • In 1-2 sentences, please describe what interests you about this role at CloudZero.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT