Mercor

Mercor

Security GRC Lead

San Francisco · Senior

Sponsorship not specifiedDetected 38 days ago
PythonSQLMachine LearningLLMsComplianceProcurementCadenceHIPAASharePoint

Stay score

odds of building a lasting career here

40Risky
Cap-exempt (no lottery)0
Sponsors this role90
Entry-level history0
PERM / green-card track0
Lottery odds40
Fits your clock70

Thin sponsorship signal and lottery-bound. A low-probability bet with your clock running. Prioritize cap-exempt roles and proven entry-level sponsors first.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • A customer-audit machine that responds tocustomers

Requirements

  • You translate cloud-security language to auditor language and back without losing precision - you can read a Wiz finding, a Panther rule, an IAM policy, and say what control it maps to
  • You know the difference between "we don't have a control for that" and "we have a compensating control" and you don't fabricate the second one

Nice to have

  • Experience with FedRAMP Moderate, HIPAA, PCI DSS, or SOC 2 + HITRUST dual scope
  • You've automated questionnaire response with an LLM and know where it works and where it fails
  • Prior experience standing up a third-party risk program from zero - vendor intake, recurring review, contract teeth
  • This is the first GRC seat.
  • You set the operating cadence, pick the tools (we're already on Vanta), define the rituals.
  • Compliance work that closes deals.
  • Every audit you nail is a contract that signs.
  • You'll see the revenue downstream of your work in the same week.

Compensation

  • You'll own the operating cadence of a continuously-audited company: continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA.

Benefits

  • Bi-annual performance bonus structure
  • Generous equity grant vested over 4 years
  • Up to $15k Relocation bonus
  • $10K housing bonus (if you live within 0.5 miles of our office)
  • $1.5K monthly stipend for meals
  • $200 monthly laundry reimbursement
  • $200 monthly personal wellness reimbursement
  • Health, Dental, Vision insurance

Company info

  • continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA.
  • You'll write controls in code where it makes sense, push back on tools that fight you, and own the artifacts that close enterprise deals.
  • We use AI heavily in our own GRC work.
  • You should be comfortable using LLMs to draft, review, and respond at speed.
  • If you've ever copy-pasted the same answer into 14 vendor questionnaires by hand, you'll appreciate not having to.
  • We're in-person five days a week at our SF headquarters, with first Fridays remote.
  • The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act conformity - your call on sequencing)
  • The third-party risk program - formal intake, recurring review cadence, evidence requirements - tied into procurement so vendors can't be onboarded around it
  • Policy lifecycle owned end-to-end: version, attestation, exception handling, review cycle - not a SharePoint graveyard
  • Controls-as-code where it makes sense: integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection
  • Data-handling procedures: the customer-data-deletion gap, DSAR workflow, KMS scheduled destruction, offboarding handlers
  • The internal trust narrative: customer trust pages, security one-pagers, executive-ready disclosure templates when something goes sideways
  • 7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under audit by enterprise customers
  • You've shipped at least one ISO 27001 certification from kickoff to issued certificate, including Stage 1 and Stage 2 with a real registrar
  • Fluent in Vanta (or Drata, Secureframe, Sprinto) at the integration and admin level, not just the reviewer UI - you've configured connectors, written custom tests, debugged broken evidence
  • You write controls as code or query evidence with SQL when the platform falls short - Python, SQL, or shell, whatever it takes
  • Direct experience with the customer-trust surface: SIG, CAIQ, custom enterprise questionnaires, on-site auditor sessions, disclosure letters under legal review
  • Built or operated a GRC program inside an AI lab, ML platform, or company serving frontier labs as customers
  • Familiar with AI-specific frameworks: NIST AI RMF, EU AI Act conformity, ISO 42001
  • Written a public trust page that customers actually trust
  • Build the function, don't inherit it. This is the first GRC seat. You set the operating cadence, pick the tools (we're already on Vanta), define the rituals.
  • Compliance work that closes deals. Every audit you nail is a contract that signs. You'll see the revenue downstream of your work in the same week.
  • AI-native GRC. You'll use frontier models daily - evidence review, questionnaire drafting, control mapping - and have engineering support to build whatever tooling the off-the-shelf platforms won't.
  • Direct line to the auditor and the customer. No layers between you and the people who matter - the audit firm, the customer security team, our outside counsel. You own the relationship end-to-end.
Apply directly at Mercor →Create a free account for alerts like thisView Mercor immigration profile

This listing is sourced directly from Mercor's careers page and normalized into a canonical job model.