Security GRC Lead

Mercor's first governance, risk and compliance hire, owning the compliance operation for a company that handles training data, evaluations and human-feedback pipelines for frontier AI labs, plus payments and KYC for more than 300,000 experts. The lead runs continuous SOC 2 Type 2 monitoring, completes the ISO 27001 buildout, chooses which of HIPAA, FedRAMP Moderate or EU AI Act conformity comes next, handles quarterly customer audits and fast questionnaire turnaround, and builds third-party risk, policy lifecycle, data deletion and DSAR procedures, controls-as-code and customer trust materials.

Mercor wants seven or more years in security GRC, compliance engineering or audit, two owning SOC 2 Type 2, at least one ISO 27001 certification delivered, admin-level Vanta or similar, and Python or SQL. The role is in person in San Francisco five days a week, with first Fridays remote.