- Drive GRC workstreams from initial request through evidence collection, testing, remediation, and completion.
- Keep the company audit-ready throughout the year.
- Test security controls and assess whether they are working.
- Conduct risk assessments, identify gaps, and help teams develop remediation plans.
- Map controls across SOC 2 and other frameworks.
- Coordinate access reviews, control testing, policy reviews, risk updates, and audit evidence requests.
- Review vendors’ security practices and support customer security questionnaires.
- Draft and maintain policies, standards, control narratives, risk records, metrics, and program documentation.
- Track findings and remediation commitments, follow up with owners, and keep issues moving toward resolution.
- Simplify and automate repetitive GRC work and help develop governance for AI products, agents, and new ways of handling data.