Information Security GRC Lead, Smarsh
Cloud-based archiving and compliance solutions
Be an early applicant
Cloud-based archiving and compliance solutions
1001+ employees
Be an early applicant
1001+ employees
Company mission
To enable customers to take advantage of the latest communication and collaboration tools, while staying ahead of compliance risk.
Role
Who you are
- This is a strategic yet hands-on role, ideal for someone who thrives in driving governance initiatives, facilitating risk discussions, and ensuring compliance readiness while working closely with Engineering, Security, and Product teams
- 7–10 years’ experience in security governance, risk, or compliance roles within SaaS or regulated industries
- Strong track record operationalising ISMS frameworks, managing control assurance, and supporting external audits
- Hands-on experience with GRC platforms, security metrics reporting, and risk assessments
- Proven ability to work across business, engineering, and legal teams to embed governance effectively
- Familiarity with modern regulatory landscapes and frameworks such as ISO 27001, SOC 2, GDPR, DORA, FedRAMP and SEC Cyber rules
- Strong communication skills, with the ability to create executive-level reporting and artifacts
- Experience leading client assurance programmes or third-party risk management
- Professional certifications (CISA, CISM, ISO 27001 LA, CISSP, CRISC) preferred
What the job involves
- As a senior member of the GRC team, you will be instrumental in ensuring that our security governance, risk, and compliance efforts are integrated, scalable, and proactive
- The GRC Lead plays a cross-functional leadership role, supporting the Senior Manager, GRC, and taking ownership of key programmes that span our ISMS, controls assurance, risk management, third-party oversight, and regulatory compliance
- You’ll engage with stakeholders across InfoSec, Legal, Product, Engineering, and Customer teams to operationalise governance and build trust
- You must be comfortable working as part of a global team in a dynamic, fast-paced environment
- Collaboration across time zones and geographies is a key part of our culture and success
- Lead the maintenance and continuous improvement of Smarsh’s ISO 27001-aligned ISMS
- Oversee the control assurance programme, ensuring robust evidence collection, control testing, and continuous monitoring
- Own key internal and external audit workstreams, including SOC 2, ISO 27001, FedRAMP and customer audits
- Drive the risk assessment lifecycle, embedding business, technical, and supply chain risk perspectives
- Enhance risk methodologies and tools, integrating real-time risk metrics into dashboards and governance forums
- Support risk acceptance processes and facilitate cross-functional remediation plans
- Monitor emerging regulations (e.g. DORA, SEC, UK AI Act) and translate them into actionable internal obligations
- Manage customer security assessments and DDQs, enabling frictionless trust through reusable assurance artefacts
- Coordinate timely, high-quality client responses and external assurance artefacts
- Lead third-party security reviews and ensure governance controls are extended across the vendor lifecycle
- Partner with Procurement and Legal to align contractual security requirements and risk acceptance criteria
- Maintain the InfoSec policy lifecycle and track compliance across business units
- Develop and maintain security governance metrics and reporting for the CISO and wider executive team
- Support the operation of governance forums and steering committees
- Deliver targeted security training and awareness campaigns aligned to regulatory and business needs
- Promote a security-aware culture of governance accountability and enablement across teams
- Own and refine core GRC workflows, including documentation, issue tracking, evidence management, and status reporting
- Maintain and expand GRC tooling integrations, ensuring high-quality automation and reporting outputs
Salary benchmarks
Our take
The emergence of new digital communication technologies provides businesses with a great opportunity for growth. But regulated businesses need to ensure they carry out communications monitoring, archiving, and compliance to stay on the right side of regulators. This can be difficult to do with new tech - to the extent that some businesses are hesitant to adopt it at all.
Of course, there’s a substantial appetite for ways to get around this obstacle and therefore reap the business benefits of modern comms. Smarsh provides just that, with its suite of archive, storage, and monitoring tools. In the two decades since its founding, the platform has netted over 6,500 clients including top worldwide banks, brokerage firms, insurers, registered investment advisors, and state and local government agencies in the US.
This puts Smarsh in a formidable position going forward. The issue the company addresses is only getting more acute as the volume of communications increases, more tech is brought to market, and the hybrid work model pushes more communications online. Smarsh’s extensive, top-tier global reach will help it field this growing market opportunity.
Freddie
Company Specialist at Welcome to the Jungle
Insights
-9% employee growth in 12 months
Company
Funding (2 rounds)
May 2015
$28m
LATE VC
Sep 2007
$15.6m
LATE VC
Total funding: $43.6m
Company benefits
- Healthcare insurance: We provide medical, dental and vision insurance and a flexible spending account that allows you to set aside pre-tax dollars to pay for eligible out-of-pocket expenses
- Personal time off: A healthy work-life balance is critical to your success at the office. Smarsh offers a "take-what-you-need" time off policy as well as flexible work arrangements
- Recognition: We're big on kudos for a job well done. Our employee recognition program enables co-workers to nominate their peers who best embody our core values for recognition
- Life and disability insurance: Fully paid life and disability insurance coverage is provided from the day you start your job
- Wellness program: You're happier when you're healthier. So we reimburse a portion of employees' monthly health club expenses
- Retirement savings: We match a percentage of your retirement savings contributions. Smarsh employer match invests immediately, so it's yours from day one
- Sabbatical: The Smarsh sabbatical program provides a time to recharge, study or simply a time to do something you are passionate about away from the workplace. Employees are eligible after six years of service
- Giving back: Through our community partnership program, Full Circle, employees make a positive difference and receive paid time off for Full Circle activities so they can support the organizations that matter most to them
- Employee assistance program: We offer free and confidential assessments, short-term counseling, referrals and follow-up services to employees for personal or work-related issues to support their mental and emotional well-being
- Cellphones: To support our mobile and geographically dispersed workforce, we offer corporate cellular plan discounts with both AT&T and T-Mobile
- Getting here and home: Biking and taking public transit to work is not only cool but a smart and green thing to do. Smarsh proudly reimburses for monthly transit costs and biking expenses
- Parental leave: We want to support our colleagues who are starting a family. Smarsh offers paid leave to help you welcome your new bundle(s) of joy into the world
Company HQ
Portland Downtown, Portland, OR
Leadership
Stephen Marsh
(Founder)Previously worked on capital market systems at Fidelity Investments, and then moved to a Senior Product Manager role at CCBN. They are also a board member at The Wild, Asset Compliance Inc., and ComplySci.
Share this job
View 9 more jobs at Smarsh