Manager of the GRC Product Subject Matter Experts, Vanta
$230-311k
+ Equity
Senior and Expert level
Remote from US
AI trust management platform
Open for applications
AI trust management platform
1001+ employees
B2BSecurityComplianceSaaSCyber SecurityAutomation
Open for applications
$230-311k
+ Equity
Senior and Expert level
Remote from US
1001+ employees
B2BSecurityComplianceSaaSCyber SecurityAutomation
Company mission
To help businesses earn and prove trust.
Role
Who you are
- If you're someone with deep GRC expertise, a track record of developing people, and the program instincts to drive a high-volume content and product release engine, we'd love to hear from you
- 7+ years of GRC and/or Information Security experience, with hands-on implementation or assessment across multiple frameworks (e.g., SOC 2, ISO 27001/27701, HIPAA, PCI DSS, NIST CSF/800-53); experience with cloud environments and SaaS strongly preferred
- 2+ years of experience managing technical or subject matter expert teams, with a passion for developing people and building a culture of quality and accountability
- Experience owning or heavily contributing to programs that span Product, Engineering, and GTM — ideally including content lifecycle, framework release, or compliance product work
- Strong program management instincts: comfortable defining process, driving prioritization, and holding cross-functional partners accountable to release plans and quality bars
- Deep GRC craft — controls, risks, testing approaches, evidence standards, and program operations (policies, risk registers, POA&M, vendor risk, continuous monitoring)
- Product mindset — able to coach the team on translating customer and regulatory needs into productizable capabilities, with comfort using data to prioritize
- Technical and automation fluency (AI-augmented) — comfortable using AI pair-programming and LLM tools to accelerate drafting of specs, mappings, and test logic, and able to set safe-use guidelines, evaluation practices, and reusable patterns for the team
- Analytical and detail-oriented — skilled at precise control wording, mapping accuracy, and evidence specificity; comfortable working with spreadsheets and large data sets
- Excellent written and verbal communication; able to partner effectively with engineers, designers, GTM teams, auditors, and customers, and to represent the team's work to executives
- Self-motivated and adaptable in a fast-paced environment, with a track record of leading teams through change
- Federal experience (e.g., FedRAMP, CMMC, StateRAMP) a plus but not required
- Privacy regulation experience (GDPR/CCPA), audit/assessor background experience a plus
- Certifications preferred but not required — one or more of: CISA, CISSP, CCSK/CCSK+, ISO 27001 Lead Implementer/Lead Auditor, CIPM/CIPT, PCI-ISA/QSA
- Open to using AI to amplify their skills and strengthen their work - demonstrating curiosity, a willingness to learn, and sound judgment in applying AI responsibly to improve efficiency and impact
What the job involves
- As Vanta rapidly grows and moves upmarket, we're working with increasingly sophisticated customers who have complex security and compliance needs across a wide range of industries and geographies
- The GRC Subject Matter Experts, Product team sits at the heart of how Vanta meets that demand — they are the GRC authorities behind every framework, test, and piece of compliance content the platform ships, and they partner directly with Product, Engineering, and Design to shape the GRC Frameworks part of the product
- As the Manager of the GRC Product Subject Matter Experts team at Vanta, you will lead the team responsible for the lifecycle, quality, and product integration of Vanta's frameworks, tests, and broader GRC content
- Your team spans commercial frameworks, government frameworks, test authoring, framework quality uplift, and framework maintenance, and their work touches everything from SOC 2, ISO 27001/27701, HIPAA, PCI DSS, and NIST to FedRAMP and emerging regulations
- You will manage and develop this team while also owning and governing the end-to-end framework release process in partnership with Product and Engineering
- You'll join Vanta's Security organization, which provides essential security operational services, is directly involved in the software development process, sets policies and standards regarding enterprise-wide security requirements, and offers advisory services to enable our business to thrive while effectively managing risk
- Hire, mentor, and develop a team of SMEs covering commercial frameworks, government frameworks, test authoring, framework quality uplift, and framework maintenance — planning for current and future capacity needs, setting the bar for technical depth and content quality, and preparing high performers for broader scope
- Build a stable, motivated team environment with clear operating rhythms, delegating effectively to grow ownership and capability, and partnering with your leader and People Business Partner to spot and address team health issues early
- Connect the team's roadmap and content priorities to Vanta's broader product and company strategy, anticipating near-term shifts in customer needs, regulatory landscape, and product direction, and adjusting focus to keep the team aligned
- Create open feedback loops within the team and adapt how you communicate priorities, decisions, and risks across different audiences — from individual contributors to engineering, GTM partners, customers, and executives
- Lead the team through change with steadiness while holding yourself and them accountable for commitments — communicating progress and risks proactively, addressing misses directly, and creating an environment where mistakes are treated as learning opportunities rather than blame
- Own and govern Vanta's framework release process end-to-end, partnering with Product and Engineering to define the playbook for how new frameworks, framework updates, automated tests, crosswalks, and content are scoped, built, reviewed, and shipped
- Drive the program management work that surrounds GRC content — including new framework launches, framework updates, update notes, customer escalations, content and test requests, PMM material reviews, and licensing and pricing input
- Track team performance and report KPIs and metrics to security and product leadership, including framework release velocity, content quality, adoption, time-to-evidence, and customer impact
- Break down ambiguous and competing priorities — across framework launches, framework updates, test authoring, and quality uplift — into clear, actionable decisions, balancing customer demand, market opportunity, and engineering capacity, and escalating complex tradeoffs with context and a recommended path forward
- Lead the quality uplift effort for older commercial frameworks, ensuring Vanta's full library meets a consistent and modern standard for control wording, evidence specificity, and testing method
- Set direction for the team's work on crosswalks and mappings across security and privacy frameworks, including canonical control IDs, mapping confidence, and evidence data dictionaries, and partner with Engineering to operationalize them in-product
- Steer the team's contribution to the broader GRC product surface — risk management, issue and corrective action management (POA&M), policy management, access reviews, Trust Center, and third-party risk management
- Partner with Product Management and Design to ensure SMEs are effective product advisors across discovery, PRD authoring, UI/UX review, and usability testing
- Champion AI-assisted compliance on the team — coaching SMEs to translate domain knowledge into machine-readable specs, evaluation sets, and guardrails, and partnering with Engineering and ML to ship LLM-powered guidance and automation
- Partner with Sales, Customer Success, and Product Marketing to represent the framework portfolio externally and contribute to pricing, packaging, and licensing conversations (including frameworks such as HITRUST)
- Serve as a senior escalation point for customer issues related to framework content, scoping, and interpretation
- Provide input and feedback on the development of GRC product features that depend on the team's content and expertise
Our take
The security auditing process is usually very time-consuming, taking hours to complete, and it is often difficult for startups to invest time into such a process. Yet, the benefits of security accreditation are enormous, mainly as many such businesses are working globally and need ways to demonstrate security compliance to one another. Vanta works specifically with startups to help them complete and pass security audits such as SOC 2 and ISO 27001.
The company is a compliance portal and security monitoring platform that businesses use to assess their risk levels. Vanta carries out a pre-audit of a company's digital security and highlights areas that need to be worked on before a full analysis of all threats is carried out. Other businesses such as Datadog or PagerDuty offer similar security monitoring services, but Vanta monitors its customers throughout the year, allowing any issues to be identified and addressed early on.
Vanta's latest $150M raise, boosting its valuation to $4.15B, highlights the company's rapid growth and strong market position. With AI-driven automation, expanding government partnerships, and strategic acquisitions on the horizon, Vanta is scaling quickly while solving real customer problems. Backed by a talented leadership team and a growing customer base, the company looks set to continue its upward trajectory and build a lasting, sustainable business.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
Led by a woman
Top investors
Company
Funding (last 2 of 6 rounds)
Jul 2025
$150m
SERIES D
Jul 2024
$150m
SERIES C
Total funding: $500.2m
Company benefits
- Health & Wellness: Vanta values the health and well-being of our teammates and offers comprehensive medical, dental, and vision coverage for teammates and dependents. Vanta is excited to provide an additional range of benefits that holistically support your physical, emotional, and financial wellbeing
- Work Your Way: Enjoy a remote-first setup if you're in the US, or go hybrid at our international offices
- Paid Parental Leave: Industry competitive paid parental leave for all parents
- Time Away: Industry competitive and generous PTO policy
- 401K Plan: 401k matching contribution plan
Company HQ
Civic Center, San Francisco, CA
Leadership
Christina Cacioppo
(Founder & CEO)Prior to co-founding Vanta in 2017, Christina worked in Product Management for Dropbox. She was also a Professor at the School of Visual Arts and worked on the Investment Team at Union Square Ventures.
Share this job
View 88 more jobs at Vanta