At a glance
- Experience
- 5+ years experience
- Location
- Tel Aviv/ Netanya · Netanya/Tel Aviv
About the role
- We are seeking an experienced GRC Manager (Governance, Risk, and Compliance) to lead and mature key areas of JFrog’s global Governance, Risk, and Compliance program.
- This role will manage members of the GRC team, including the GRC Specialist, and will be responsible for driving JFrog’s corporate compliance, customer assurance, risk management, audit readiness, and trust programs.
Responsibilities
- Lead and develop GRC team members, including the GRC Specialist, by establishing priorities, providing guidance, reviewing deliverables, and supporting professional development.
- Own and mature key components of JFrog’s global GRC program, ensuring governance, policies, controls, risk-management activities, and compliance processes remain effective and scalable as the company grows.
- Manage and support security certifications, attestations, and compliance programs, including ISO 27001, SOC 2 Type II, and other applicable industry and regulatory frameworks.
- Lead internal and external audit activities, coordinating evidence collection, stakeholder participation, remediation activities, and responses to auditors, assessors, customers, and other external parties.
- Lead and mature the Third-Party Risk Management (TPRM) program, overseeing third-party security assessments, risk identification and treatment, remediation tracking, risk acceptance, ongoing monitoring, and reporting to ensure third-party risks are appropriately identified and managed.
- Drive policy and control governance, ensuring JFrog policies, procedures, standards, and controls remain aligned with applicable regulatory requirements, contractual commitments, business objectives, and industry best practices.
- Partner with Sales and customer-facing organizations to improve compliance enablement, develop reusable resources, to help the Customer Trust team efficiently respond to security and compliance requirements from prospective and existing customers.
- Identify opportunities to automate and scale GRC processes, including the use of GRC platforms, trust-center technologies, workflow automation, and AI-enabled solutions.
- Monitor regulatory, industry, and customer-driven changes and assess their potential impact on JFrog's compliance obligations, controls, and GRC roadmap.
- Establish and track GRC metrics and KPIs, providing management with visibility into compliance posture, audit findings, customer assurance activities, risks, remediation efforts, and program maturity.
Requirements
- 5+ years of experience in cybersecurity governance, risk, compliance, security assurance, audit, or a related field, with increasing levels of responsibility.
- Prior experience leading or managing GRC professionals, projects, or significant cross-functional compliance initiatives.
- Strong hands-on knowledge of ISO 27001 and SOC 2 Type II, including experience supporting or leading audits and certification activities.
- Strong knowledge of cybersecurity and risk-management frameworks such as NIST, ISO 27001/27002, CSA CCM/CAIQ, SIG, and related industry standards.
- Familiarity with privacy and regulatory requirements such as GDPR, CCPA/CPRA, and ISO 27701.
- Experience performing or managing cybersecurity risk assessments, documenting risks, working with risk owners, and tracking remediation.
- Experience working with external auditors, assessors, customers, regulators, and internal stakeholders.
- Strong understanding of cloud environments and SaaS security and compliance considerations.
- Experience implementing, administering, or optimizing GRC, trust-center, audit-management, or compliance automation tools.
- Demonstrated ability to manage multiple complex initiatives simultaneously and drive projects to completion across geographically distributed teams.
Skills
- ISO 27001
- SOC 2 Type II
- NIST
- CSA CCM
- CAIQ
- SIG
- GDPR
- CCPA
- CPRA
- ISO 27701
