Source Job

• Own and mature internal and Managed GRC programs, including federal SSPs, POA&Ms, audits, and risk assessments.
• Collaborate with CISOs, engineers, and control owners to translate compliance requirements into practical technical controls.
• Lead and develop a GRC team while introducing automation and AI to improve scalability and consistency.

The company provides managed Governance, Risk & Compliance (GRC) and security assurance services, with a strong focus on federal security programs and frameworks like NIST, SOC 2, and CMMC. It supports a growing GRC team and emphasizes low-ego collaboration, automation, and AI-enabled approaches to scale delivery.

• Lead and develop the Information Security GRC strategy, roadmap, operating model, and governance cadence.
• Coordinate SOC 2, DORA/CySEC-related assurance, internal and external audits, and regulatory requests.
• Build, develop, and manage the GRC team and improve GRC efficiency through automation and reusable evidence.

JustMarkets is an international FinTech company. It is a growing organization with a focus on information security and compliance.

• Develop, implement, and manage GRC strategies to support compliance with frameworks like FedRAMP, IRAP, and SOC 2.
• Lead security assessments, audits, and certification processes, ensuring timely and successful completion.
• Collaborate with cross-functional teams to integrate GRC requirements into operations and technology.

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity, improve operational efficiency, and reduce security and compliance risk. More than 50 million registered users and over 50% of the Fortune 100 trust GitLab, driven by a high-performance culture of continuous knowledge exchange.

• Own and mature the compliance framework, including continuous controls monitoring, security awareness, and audit coordination.
• Automate GRC processes using compliance platforms and AI tooling for evidence collection and risk management.
• Develop policies, manage third-party risk, and scale customer security assurance end-to-end.

Monarch is an all-in-one personal finance platform that simplifies finances. Since 2021, they have become the top-recommended app, with a fully remote, AI-driven team focused on building a product people love.

• Lead cybersecurity governance, assessment, and audit activities supporting a federal customer.
• Coordinate evidence, control assessments, and remediation across NIST, RMF, and federal compliance requirements.
• Maintain quality control, configuration traceability, and readiness for IV&V, QA, and government surveillance.

SkyePoint Decisions is a cybersecurity architecture, engineering, and IT services provider supporting federal government clients. Headquartered in Dulles, Virginia, it is an ISO-certified small business with a collaborative culture focused on mission assurance.

• Lead compliance assessments and build-out of IL4/IL5 authorizations for DoD Cloud Computing Security Requirements Guide.
• Maintain and evolve compliance posture for FedRAMP High, NIST SP 800-53, and other federal frameworks.
• Serve as GRC liaison to engineering teams, translating complex federal compliance requirements into technical specifications for AWS environments.

Horizon3 is a fast-growing, remote cybersecurity company that provides autonomous pentesting through its NodeZero platform. The company is a fusion of former Special Operations cyber operators and engineers, fostering a culture of respect, collaboration, ownership, and results.

• Build and maintain compliance frameworks in the Secfix platform, including ISO 27001, TISAX, SOC 2, GDPR, and more.
• Own internal audits end-to-end for customers, ensuring they are prepared for external audits.
• Collaborate with product and engineering to translate compliance gaps into structured product work and enhance platform quality.

Secfix automates security compliance for European companies, helping them achieve ISO 27001, GDPR, TISAX, and SOC 2 efficiently. They are a 100% remote team with hubs in Munich, Berlin, and London, recently raised a $12M Series A, and are backed by top VCs.

• Lead projects from client acquisition to final delivery and oversee client service teams on multiple engagements.
• Perform technical security assessments, audits, and risk evaluations across applications and infrastructure.
• Mentor and develop staff while cultivating client relationships and cross-selling firm services.

The Bonadio Group is a leading accounting, advisory, and consulting firm providing next-level solutions to clients across industries. The firm values diversity, innovation, and professional growth, offering mentoring and training programs with a path to partnership.

• Lead security risk assessments across engineering, IT, operations, and business functions.
• Maintain a risk register and provide leadership with a clear view of the company's risk posture.
• Partner with teams to drive remediation of risks and map controls to compliance frameworks like NIST 800-171.

Muon Space is an end-to-end Space Systems Provider that designs, builds, and operates LEO satellite constellations delivering mission-critical data. Founded in 2021, the company operates a state-of-the-art facility in Silicon Valley and is committed to fostering a diverse and dynamic workforce.

• Own end-to-end audit evidence collection and validation across multiple compliance frameworks including FedRAMP, ISO 27001, and SOC 2.
• Maintain and continuously verify technical controls across GCP, GitHub, and Microsoft 365 environments.
• Serve as the primary liaison between GRC and technical teams to reduce audit burden and ensure continuous audit readiness.

A-LIGN is a leading provider of cybersecurity compliance programs, offering services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. They are the number one issuer of SOC 2 and HITRUST and a top three FedRAMP assessor, operating in a high-growth, PE-backed environment.

• Lead end-to-end service delivery for cybersecurity professional services, ensuring quality, timelines, and compliance for a portfolio of customers.
• Drive operational strategy, governance frameworks, and KPIs for predictable delivery across FedRAMP advisory, implementation, and continuous monitoring programs.
• Mentor and grow high-performing technical teams including project managers, cloud architects, security engineers, and analysts.

Quantum Sky engineers cybersecurity and cloud solutions for U.S. Federal agencies, focusing on FedRAMP, RMF, and post-quantum mission needs. The company fosters a collaborative, innovative, mission-driven culture with a high-performing team of technical professionals.

• Own the overall security posture, including policy, standards, and risk framework.
• Manage ISO 27001, SOC 2, FedRAMP, and CMMC compliance programs.
• Lead incident response, vulnerability management, and customer security assurance.

RapidFort is a cybersecurity company that helps organizations secure and optimize their software supply chain and containerized environments. As a fast-growing startup, we foster a culture of ownership and direct communication, where every team member contributes to our mission of securing cloud-native applications for regulated industries.

• Own the compliance function as its sole occupant, reporting to the Head of Engineering and partnering with the Security Lead on policies, audits, and evidence.
• Manage the Q&A library, customer security reviews, audit calendar, and third-party risk to keep Duvo reviewable for buyers and auditors.
• Deliver precise, evidenced answers that stand up to hostile reviewers and keep the trust center and subprocessor list current.

Duvo builds an AI operations platform for large enterprises, enabling customers to create AI agents that automate business-critical processes across systems like SAP, spreadsheets, and supplier portals. The company is growing fast and values velocity, direct feedback, autonomy, and heavy use of AI tools.