Senior GRC Specialist
San Mateo · New York · Remote · 5-7 years experience · Full-time · Posted Sep 23, 2026
At a glance
- Experience
- 5-7 years experience
- Employment
- Full-time
- Location
- San Mateo · New York · Remote
About Fireworks AI
- Fireworks is the platform for specialized intelligence, enabling companies to build, train, and serve AI models tailored to their own data, workflows, and products. Founded by the team behind PyTorch and backed by AMD, Atreides, Benchmark Capital, Index Ventures, Lightspeed, NVIDIA, Sequoia Capital, and TCV, Fireworks powers production AI with hundreds of state-of-the-art open models across text, image, embedding, audio, and multimodal workloads. Today, Fireworks is a Series D company valued at $17.5 billion, bringing together an ambitious, collaborative team that's building the future of enterprise AI.
About the role
- We're looking for a GRC Specialist to join our security and compliance team to help mature our compliance program across frameworks like SOC 2, HIPAA, ISO 27001, ISO 27701, ISO 42001, and GDPR.
- You will support audits, manage risk, and partner with engineering and operations teams to keep our controls effective as we scale.
- From day one you'll own operational cornerstones of our program, including user access reviews, our security awareness program, and third-party risk management.
Responsibilities
- Own day-to-day GRC operations including user access reviews and certifications, security awareness and phishing/deepfake simulation facilitation, JML tracking, and triage and enforcement of policy and control exceptions.
- Run the risk management program by performing annual and ad-hoc risk assessments, maintaining the risk register, partnering with risk owners on remediation, and tracking issues through to closure.
- Manage third-party risk by running vendor and subprocessor risk assessments, conducting ongoing monitoring, and tracking remediation across critical vendors.
- Design and execute targeted internal audits to test control effectiveness, and facilitate or support external audit cycles by coordinating evidence, control owners, and remediation.
- Own continuous control monitoring and evidence automation by administering our GRC platform, keeping automated control tests and evidence healthy, and maintaining audit readiness year-round.
- Build and foster relationships with cross-functional partners across engineering, IT, operations, legal, and sales.
- Partner with control owners to educate them on their control responsibilities, ownership, and expectations, preparing them for audits and helping them operationalize controls.
- Keep the policy library current by reviewing and updating security policies, standards, and procedures to stay practical and aligned to operating frameworks.
- Turn program data into action by translating access review, awareness, and risk findings into insights and metrics that flag high-risk users, teams, or behaviors, report to leadership, and drive targeted interventions.
- Take on additional GRC projects as the program evolves.
Requirements
- 5-7 years of experience in GRC, IT audit, information security, or a closely related field
- Working knowledge of major security and privacy frameworks such as SOC 2, ISO 27001/27701/42001, NIST CSF, HIPAA, GDPR, or CCPA
- Experience with GRC platforms (Anecdotes, Vanta, Drata, Secureframe, OneTrust, ServiceNow GRC)
- Experience running user access reviews and a solid understanding of identity and access management concepts (RBAC, least privilege, segregation of duties, JML processes)
- Hands-on experience administering a security awareness or phishing simulation platform (Adaptive Security, KnowBe4, Hoxhunt, Proofpoint, or similar)
- Comfort with cloud environments (AWS, GCP, or Azure) and how SaaS products are built and operated
- Strong written communication to translate control requirements and security concepts into language engineers, customers, and non-technical employees understand
- Detail-oriented and organized, with the ability to juggle multiple audits, campaigns, and deadlines
- A collaborative mindset with enjoyment for working across teams rather than gatekeeping
Skills
- SOC 2
- HIPAA
- ISO 27001
- ISO 27701
- ISO 42001
- GDPR
- Anecdotes
- Vanta
- Drata
- Secureframe
- OneTrust
- ServiceNow GRC
Show all 15 skills
- AWS
- GCP
- Azure
