At Vanta, our mission is to help businesses earn and prove trust.We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it.Â
As Vanta rapidly grows and moves upmarket, weâre working with increasingly sophisticated customers who have complex security and compliance needs across a wide range of industries and geographies. The GRC Subject Matter Experts play a critical role in delivering high-quality, scalable content and product guidance to help these companies effectively manage their GRC programs.
As Vantaâs newest GRC Subject Matter Expert, youâll be responsible for developing and maintaining multi-framework GRC solutions used by thousands of customers. Acting as a bridge between Product Management, Engineering, Design, Sales, and Customer Success, youâll ensure our solutions align with key security, privacy, and risk frameworks and real-world customer needs. Youâll play a pivotal role in designing, validating, and improving compliance-related content and capabilities while providing strategic input to shape Vantaâs GRC product roadmap.
Youâll join Vantaâs Security organization, which provides essential security operational services, is directly involved in the software development process, sets policies and standards regarding enterprise-wide security requirements, and offers advisory services to enable our business to thrive while effectively managing risk. If youâre someone who has high initiative and enjoys solving complex problems with real customer impact, weâd love to hear from you!
What youâll do as a GRC SME at Vanta:
Build and maintain compliance frameworks - Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for standards such as SOC 2, ISO/IEC 27001 & 27701, HIPAA, PCI DSS, NIST CSF, NIST SP 800-53, and regional regulations (e.g., GDPR/CCPA). Author clear control rationales, acceptance criteria, and customer-facing guidance.
Design crosswalks and mappings (frameworkâagnostic) - Create and steward an internal commonâcontrol approach informed by industry catalogs (e.g., SCF, UCF, or similar). Maintain bidirectional crosswalks across industry leading security and privacy regulatory frameworks. Define canonical control IDs, mapping confidence, and evidence data dictionaries; version crosswalks with changelogs and traceability to source authority. Partner with Engineering to operationalize mappings inâproduct (integrations, automated tests, exceptions/exemptions, continuous monitoring workflows).
Elevate content quality and usability - Define standards for control wording, evidence specificity, testing method, and reviewer guidance. Establish content QA processes, audits, and metrics (e.g., adoption, time-to-evidence, completion rates) to continually improve outcomes.
Drive endâtoâend GRC product enablement - Build modular content, guidance, and templates for risk management (methodologies, scoring, KRIs), issue & corrective action management (POA&M), policy management (lifecycle, attestations), access reviews (SoD, recertification flows), customer trust / Trust Center artifacts, and thirdâparty risk management (TPRM) (due diligence, monitoring, contract clauses).
Act as a product advisor across discovery & design - Partner with PM/Design to support feature discovery (customer interviews, JTBD, task analysis), review UI/UX for control, evidence, and review workflows, run usability tests, and author PRDs/acceptance criteria grounded in auditor and customer needs.
Author automated tests & continuous monitoring - Translate controls/compliance knowledge and infrastructure contexts (cloud services, SaaS apps, onâprem, endpoints, networks, CI/CD) into specâlevel automated tests and detectors in Vanta. Define test logic, data sources/integrations (APIs, logs, configs), edge cases, and acceptance criteria; pair with Engineering to implement, validate, and maintain detectors with versioned mappings to frameworks for continuous monitoring.
Partner with Product to drive roadmap - Translate customer and market needs into GRC requirements, propose experiments, and validate solutions through discovery with Design/UX Research. Influence prioritization using data and field insights; own a backlog for framework/content improvements.
Enable AIâassisted compliance - Partner with Engineering/ML to design and ship LLMâpowered guidance and automation. Translate SME knowledge into machineâreadable specs (schemas, ontologies, prompts), define goldâstandard evaluation sets and acceptance criteria, and implement quality/safety guardrails (redâteaming, refusal policy, privacy controls). Instrument features to monitor accuracy and drift in production.
Synthesize feedback loops - Analyze input from customers, auditors/assessors, partners, and internal teams to identify gaps, resolve issues, and deliver iterative updates quickly and safely.
How to be successful in this role:
Experience - 5-7+ years in GRC and/or Information Security with handsâon implementation or assessment across multiple frameworks (e.g., SOC 2, ISO 27001/27701, HIPAA, PCI DSS, NIST CSF/800â53). Experience with cloud environments and SaaS is strongly preferred. Federal experience (e.g., FedRAMP) is a plus but not required.
Education (preferred) - Bachelorâs degree in Computer Science; advanced degree a plus.
GRC craft - Deep understanding of controls, risks, testing approaches, evidence standards, and program operations (policies, risk registers, issues/POA&M management, vendor risk, continuous monitoring).
Product mindset - Ability to translate requirements into productizable capabilities; comfort with experimentation and dataâdriven prioritization.
Technical & automation (AIâaugmented) - Build leverage with lightweight tools, LLMs, and automation workflows:
Use AI pairâprogramming tools (e.g., GitHub Copilot, Cursor) to accelerate drafting of specs, mappings, queries, and test logic.
Own simple automations that stitch together Sheets/Airtable, APIs, and webhooks to remove toil (e.g., mapping QA, evidence normalization, exception routing).
Design AIâaugmented workflows across teams (e.g., LLMâassisted control guidance, assessor Q&A triage, remediation suggestions) and measure outcomes (precision/recall, timeâtoâevidence, FP/FN rates).
Establish safeâuse guidelines and reusable patterns for prompts/agents (versioning, evaluation, privacy) and enable adoption with playbooks and templates.
Analytical & detailâoriented - Skilled at precise control wording, mapping accuracy, and evidence specificity; comfortable working in spreadsheets and large data sets (lookups, pivots).
Communication & collaboration - Excellent written and verbal skills; able to partner effectively with engineers, designers, GTM teams, auditors, and customers.
Self-motivated and independent - Able to work autonomously while contributing to team success.
Helpful and resourceful - Willing & excited to support cross-functional teams and improve compliance content.
Adaptable in a fast-paced environment - Skilled at managing change, solving problems proactively, and taking initiative.
Niceâtoâhave - Experience with privacy regulations (GDPR/CCPA), risk quantification (e.g., FAIR), audit/assessor background, or B2B SaaS content/enablement.
Certifications (preferred, not required) - One or more of: CISA, CISSP, CCSK/CCSK+, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPT, PCIâISA/QSA.
Open to using AI to amplify their skills and strengthen their work - demonstrating curiosity, a willingness to learn, and sound judgment in applying AI responsibly to improve efficiency and impact
What you can expect as a Vanta'n:
Vanta
https://vanta.com