GRC Manager

About The RoleCloudZero is growing fast. Our customer base is expanding, the regulatory and risk landscape is getting more complex, and the business needs a GRC function that can keep pace. As the GRC Manager at CloudZero, you’ll own and scale our governance, risk, and compliance programs across the organization.Reporting to the Sr. Director of IT & Security within the Office of the CTO organization, you’ll partner closely with Legal, Engineering, Product, Sales, and G&A to build a GRC function that protects CloudZero’s interests, earns customer trust, and gives the business the confidence to move quickly.This is a high-impact, highly cross-functional role. You’ll be as comfortable presenting a risk register to leadership as you are helping a sales team close a deal with the right compliance documentation. This is a hybrid role with an expectation of in-office presence 2–3 days per week.What You’ll DoDesign and Operate the GRC FrameworkDesign and operate a comprehensive GRC framework spanning governance structures, enterprise risk management, and compliance programs that grows alongside CloudZero’s businessOwn audit and certification programs including SOC 2 and other relevant standards, coordinating across internal teams and third-party auditors to drive successful outcomesOwn the development, maintenance, and ongoing improvement of CloudZero’s security and privacy policies and procedures, ensuring they’re current, practical, and embedded into how teams actually operateLead regular enterprise risk assessments, maintain a living risk register, and create an environment where risk-informed decision-making happens at every level of the organizationGovernance, Risk & Business ContinuityServe as a key stakeholder in building CloudZero’s AI Governance & Strategic Risk strategyTake full ownership of business continuity and disaster recovery programs, including program design, documentation, regular testing cycles, and tabletop exercises — ensuring operational preparedness when it matters mostBuild and manage third-party risk management processes, including vendor due diligence, contract reviews, and ongoing monitoring throughout the vendor lifecycleTrack regulatory developments alongside the Legal team, ensuring CloudZero meets its obligations under GDPR, CCPA, and other applicable requirementsManage the company’s security awareness training program and run internal audits to validate that controls are working as intendedSales and Revenue EnablementOwn the security questionnaire and assessment process — including VSAs, SIGs, and custom customer requests — with a primary focus on building and scaling tooling and automation that makes high-quality responses fast and repeatableReview and redline security and data privacy language in customer and prospect contracts, working closely with Legal to protect CloudZero’s interests while keeping deals on trackBuild and maintain a library of pre-approved security responses, compliance artifacts, and contract language so the team isn’t starting from scratch on every dealActively identify and implement tooling to automate questionnaire responses and security review workflows, reducing manual effort and accelerating deal cycles without sacrificing qualityMaintain and continuously improve CloudZero’s trust center, ensuring prospective customers have ready access to up-to-date security and compliance documentationPartner with Sales Engineering and Solutions teams to address security and compliance requirements early in the sales cycle, removing friction before it becomes a blockerWhat You BringGovernance, Risk & Compliance5+ years of experience in governance, risk, and/or compliance roles, ideally within a SaaS or cloud technology companyProven experience building or significantly maturing a GRC program, with direct, hands-on involvement in SOC 2 or similar certification auditsWorking knowledge of established risk management frameworks such as COSO, ISO 31000, or NIST RMFSolid understanding of GDPR, CCPA, and how data privacy obligations translate into practical controls and policiesCommunication & LeadershipStrong communicator who can make risk and compliance topics accessible and actionable for technical teams, business partners, and senior leadership alikeAbility to drive initiatives from scoping through completion while keeping multiple workstreams moving in a fast-paced environmentA business-enabling mindset — you treat compliance as something that creates competitive advantage, not just something that checks boxesBonus If You Have…Prior experience at a SaaS technology startupHands-on technical experience with GCP, AWS, or Azure from a security and compliance lensExperience working with Vanta or Drata for continuous compliance monitoring and automationExperience with security questionnaire automation tools such as Loopio, Iris, or similar solutionsProfessional certifications such as CRISC, CISA, CISM, CISSP, or CIPPFamiliarity with security frameworks including NIST CSF, CIS Controls, or OWASPProven ability to partner cross-functionally across departments to drive compliance goals and outcomesCuriosity and enthusiasm for leveraging AI tools (such as Claude, Claude Code, or similar) to work smarter, automate repetitive tasks, and continuously find new ways to drive efficiency across the GRC functionAbout CloudZeroCloud cost management is one of the biggest challenges organizations face today. As cloud adoption continues to accelerate, so do the complexities and costs associated with it, and macroeconomic conditions only increase pressure to prove cloud efficiency.CloudZero is a SaaS platform at the intersection of next-generation cloud cost management and FinOps. We ingest billing and usage data from all cloud, SaaS, and PaaS providers, organize it in real time according to our customers’ business structures, and empower organizations to make more informed business decisions.Since our founding in 2016, our mission has been to make efficient innovation a reality for every cloud-driven organization. We believe every engineering decision is a buying decision, and we’re applying proven reliability engineering principles to financial efficiency.We believe the best AI empowers users with clear insights and confident decisions, transforming complex cloud cost data into actionable intelligence that drives meaningful business outcomes.To date, we’ve raised over $56 million from leading venture capital firms. We’re solving problems of massive scale, business importance, and complexity in a space that needs it more than ever.Equal Opportunity EmployerCloudZero is an equal opportunity employer and values diversity. We do not discriminate on the basis of race, religion, color, national origin, sex, gender, gender expression, sexual orientation, age, marital status, veteran status or disability status. All job offers are contingent upon the candidate passing background and reference checks.