Director of Governance, Risk, Compliance & Trust, Everlaw
$230-312k
+ Equity Program
Expert level
San Francisco Bay Area
More information about location
3 days a week in office (Oakland, CA)
Unified platform for e-discovery and litigation
Be an early applicant
Unified platform for e-discovery and litigation
501-1000 employees
B2BLegalAnalyticsSaaS
Be an early applicant
$230-312k
+ Equity Program
Expert level
San Francisco Bay Area
More information about location
3 days a week in office (Oakland, CA)
501-1000 employees
B2BLegalAnalyticsSaaS
Company mission
To empower organizations to better navigate litigation and investigations to chart a straighter path to the truth
Role
Who you are
- You are a pragmatic, execution-oriented GRCT leader with deep experience operating regulated SaaS environments
- You bring 10+ years of experience in Information Security, Risk, or Compliance, including senior ownership of FedRAMP Moderate/High programs from authorization through steady-state operations
- You have a builder mindset, with hands-on experience implementing modern GRC automation platforms and driving a shift from manual compliance processes toward Continuous Control Monitoring
- You exercise strong risk judgment, evaluating control gaps, exception requests, and architectural trade-offs pragmatically—translating security and compliance requirements into practical, scalable engineering controls
- You are a trusted partner to Engineering, with the technical literacy to lead Security Impact Analyses (SIA) and embed compliance into DevOps and CI/CD workflows rather than bolting it on after the fact
- You bring a commercial lens to trust, with experience supporting customer assurance and GTM efforts—from complex security questionnaires to executive-level conversations with enterprise and public sector customers
- You are an operational and people leader, skilled at establishing operating rhythms, defining meaningful program metrics, driving predictable execution, and coaching high-ownership teams
- You are a clear and credible communicator, able to distill complex technical and regulatory topics into concise, actionable guidance for technical teams and senior leadership
- You have a Bachelor’s degree in Information Security, Computer Science, Engineering, Information Systems, or a related field (or equivalent practical experience) and possess relevant security certifications such as CISM, CISSP, or CISA
What the job involves
- Everlaw is seeking a pragmatic and execution-oriented Director of GRCT to lead our Governance, Risk, Compliance, and Trust function
- This role is responsible for setting the "North Star" for how we manage risk, earn customer trust, and scale compliance programs in a way that enables—rather than slows—business innovation
- Reporting to the VP of Information Technology & Security, you will own the day-to-day execution and continuous evolution of Everlaw’s risk, compliance, and trust programs, ensuring our governance posture scales with the business
- This role sits at the intersection of technical rigor and commercial enablement, partnering closely with DevOps, Product Security, Corporate Security, Legal, Engineering, Sales, and Customer teams to translate complex requirements into clear controls and credible assurances that build customer confidence
- Public Sector Compliance Ownership: Own Everlaw’s public sector compliance posture, including FedRAMP and GovRAMP authorization and ongoing maintenance
- Regulatory & Contractual Requirements: Ensure compliance with specialized regulatory and contractual requirements (e.g., CJIS, FTI), partnering with HR, Security, and Legal to support personnel, access, and operational controls
- Global & Industry Certifications: Accountable for global and industry certifications, including SOC 2, ISO 27001/27017/27018, UK CE+, GDPR, and HIPAA, enabling effective IC-led execution
- Audit Readiness & Execution: Ensure sustained audit readiness through clear control ownership, effective evidence management, and scalable compliance processes
- Strategic Certifications & Market Access: Own the go/no-go framework for pursuing new certifications or regulatory authorizations (e.g., ISO 42001), balancing customer demand, regulatory risk, and business priorities
- Regulatory Awareness: Continuously monitor emerging regulatory and industry requirements and advise leadership on impact, readiness, and timing
- Security Risk Identification & Management: Oversee the identification, assessment, and tracking of information security risks; partner with risk owners to remediate risks in a timely manner
- Security Impact Analysis (SIA): Partner with Security Engineering to lead the SIA process for major system, infrastructure, and product changes, where SecEng conducts technical SIA and GRCT evaluates risk, notification, and escalation requirements
- Third-Party Security Risk: Oversee the vendor security risk lifecycle, from onboarding through ongoing monitoring and renewal, ensuring risks are assessed and managed in proportion to data sensitivity and business criticality while supporting efficient procurement
- Pragmatic Governance & Decision Support: Maintain security policies, standards, and exception processes aligned with how Engineering, Security and IT teams operate, and act as a trusted advisor to facilitate risk-based decisions on architectural trade-offs and control exceptions
- Emerging Technology & Risk Visibility: Govern security risks related to emerging technologies, including AI/ML, and provide clear, audit-ready risk reporting to leadership that integrates with compliance and evidence pipelines
- Customer Trust Ownership: Own Everlaw’s customer-facing trust posture, ensuring external representations of security, privacy, and compliance accurately reflect internal controls and risk decisions
- Trust Center & Artifacts: Set direction and provide oversight for Everlaw’s Trust Center and related trust artifacts, ensuring content is accurate, current, and aligned with internal governance, while enabling first-line execution by the Customer Trust function
- Customer Assurance Model: Partner with Sales, Customer Success, and Legal to support customer security questions, reviews, and audits, acting as the escalation point for complex, high-risk, or non-standard requests to maintain sales velocity and deal integrity
- Strategic Engagement: Act as a subject matter expert in executive-level customer conversations on trust and security compliance topics as needed, particularly for enterprise and public sector customers
- Feedback Loop: Ensure customer trust insights and recurring assurance themes inform risk governance and compliance priorities
- Program Operations & Scalability: Drive operational excellence across GRCT programs by improving core processes, reducing manual effort, and ensuring programs scale efficiently as Everlaw grows by integrating GRC workflows directly into Engineering and Product lifecycles
- Identify and eliminate friction in high-velocity workflows such as the security questionnaire response, SIA, and vendor reviews
- Systems, Automation & Tooling: Own the evolution of the GRCT tech stack (e.g., real-time compliance platforms), increasing automation and data quality to move the organization toward automated Continuous Control Monitoring (CCM) and “audit once, satisfy many” outcomes
- Metrics & Execution Rigor: Establish clear program metrics and operating rhythms to track effectiveness, surface bottlenecks, and drive predictable execution across compliance, risk, and trust activities
- People & Team Leadership: Lead, coach, and develop GRCT team members, providing clear expectations, performance feedback, and growth opportunities while fostering a high-ownership, execution-focused culture
- Continuous Improvement & Resourcing: Champion continuous improvement by incorporating lessons learned from audits and customer feedback into program enhancements
- Manage the GRCT roadmap and resource planning to ensure the function is equipped to support Everlaw’s expanding certification requirements
Our take
Everlaw builds technology to help corporations, law firms and government entities solve the toughest problems in the legal industry. The company's platform includes features to help speed up legal work, freeing up time to be spent on more value-add activities. Everlaw’s clients include most of the top 10 class action firms in the US and it is also used by state attorney generals in every state in the US.
Law is a big industry where a lot of money is spent, but it has been largely untouched by technology until recently, leaving a big opportunity. Testament to this, the company was able to expand to Australia and New Zealand following a partnership with Australian e-discovery provider Adio. It continues to deliver new features such as "AI Deep Dive" which lets legal teams uncover and verify key evidence from documents.
The company is also pursuing growth for its Everlaw for Good Program, seen at the 2024 Equal Justice Conference in Detroit. That year, it appointed its first program director as it works to dismantle barriers to justice for low-income Americans and marginalised communities in need of legal representation. It now has over 225 participating organizations.
Steph
Company Specialist at Welcome to the Jungle
Insights
Top investors
Company
Funding (last 2 of 6 rounds)
Nov 2021
$202m
SERIES D
Mar 2020
$62m
SERIES C
Total funding: $298.6m
Company benefits
- Mind & Body - Everlaw cares about the whole person, and that is underscored by our health care plan. Everlaw offers employees and their dependents private health insurance which covers 100% of employee health insurance premiums and 60% of dependent premiums.
- Investing in Your Future - Everlaw believes in building for the long-term – for both our product and our employees. Everlaw enrolls employees in a pension fund upon hire where employees contribute 4% of their salary with a company match of 4%. An additional 1% comes from the UK government in the form of tax relief.
- Family Bonding - Everlaw supports growing families by ensuring employees receive 100% of their salary for up to 10 weeks for family-bonding leave, in addition to 8 weeks of fully paid leave for birthing parents.
- Everlawlidays and More - When you have a group of highly skilled, highly driven truth-finders, it’s important to build in breaks for recharging. Everlaw offers employees 20 days of paid holiday per calendar year in addition to the eight public holidays in England and Wales. Everlaw also recognises four ‘Everlawlidays’ that are designated days off for the whole company. Upon their fourth work anniversary, employees are upgraded to 23 days of holiday and to 27 days on their seventh work anniversary.
- On-Site Lunches and Snacks - Enjoy delicious daily catered lunches and sample the rotating snack and beverage selections in our London office.
- Never Stop Learning - We are committed to Everlawyers’ professional growth and encourage employees to pursue the right learning and development opportunities for wherever they are in their journey. With an annual Learning & Development stipend of £1,600, Everlawyers can attend conferences, obtain certifications, join classes and meet with career coaches.
- Giving Back - We are committed to supporting our local communities so we build in time for you to give back. In addition to time off for company-sponsored volunteer events, employees get four paid hours per quarter to volunteer at any charity recognised by the HMRC.
- Creating Community - Everlaw is filled with empowered, passionate problem solvers who like to have fun. From team dinners to holiday parties, Everlaw hosts optional company-wide bonding events regularly. Additionally, each department is given a monthly budget for activities and events planned by you and your colleagues. Events have included go-karting, escape rooms, trapeze classes and intramural sports.
Company HQ
Downtown, Oakland, CA
Leadership
AJ Shankar
(CEO & Founder)Previously a Senior Software Engineer at TheFind (acquired by Facebook).
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 22 more jobs at Everlaw