Founding GRC Lead

Responsibilities Pallet is hiring its first dedicated GRC leader to own how we earn and keep trust: with customers, auditors, and regulators. You’ll run our SOC 1 and SOC 2 programs, build our GDPR and CCPA privacy operations, and work shoulder-to-shoulder with engineering, product, sales, and legal to make compliance something Pallet is good at, not something it survives This role reports directly to leadership and is the foundation of a function you will one end to end, and eventually grow You’re the first. No inherited process, no legacy bureaucracy: you design the compliance operating model from a blank page, with the GRC tooling and executive support to do it right Revenue-facing, not back-office. Enterprise deals at Pallet increasingly hinge on security posture. You’ll sit in on customer conversations, own the trust narrative, and directly unblock sales Full‑spectra scope. Most GRC roles silo you into audit or privacy or vendor risk. Here you own all of it, with the engineering proximity to actually change how things get built Surround yourself with top‑tier talent and fast‑track your career: this is a foundational seat with a clear path to building and leading a team Run SOC 1 and SOC 2 Type II audit cycles end to end: control design, evidence automation, auditor relationships, and clean reports delivered on schedule, every cycle Build Pallet’s privacy program for GDPR and CCPA/CPRA: data inventory and mapping, DSAR handling, DPAs, and privacy reviews baked into product development Primary point of contact for external auditors and assessors in collecting evidence, audit responses, timelines. Translate audit findings into actionable plans Implement continuous‑compliance infrastructure so audit readiness is a byproduct of how we operate, not an annual fire drill Embed security and privacy controls into engineering and product workflows, earning adoption through partnership rather than mandate Stand up vendor risk management: security reviews, DPA negotiation support, and an ongoing third‑party risk register Own the customer‑facing trust motion (security questionnaires, trust center, customer audits) and measurably shorten enterprise sales cycles Benefits Health, Vision and Dental benefits Flexible PTO Life Insurance and Accidental Insurance Fully covered Uber ride home if you ever have to work late in the office Company paid dinners on Tuesdays and Thursdays in the office Remote office home stipend Monthly happy hours; our last one was a Golden Gate Park BBQ Commuter benefits if you live in SF 401k option; helping you save for the future Yearly learning and development stipendAnnual Company Offsites; our last one was in Sonoma Wine Country Short-Term Disability Coverage Equity for all staff Qualifications Deep hands‑on experience with compliance automation platforms and evidence workflows Built or significantly matured SOC, ISO, GDPR, and privacy compliance programs in‑house – you’ve operationalized privacy, not just advised on it Technically credible with engineers: comfortable discussing access controls, encryption, logging, and cloud infrastructure (AWS/GCP) without needing translation Startup calibrated judgment: you know which risks matter, build lightweight process, and have certifications (CISA, CISSP, ISO 27001 LA) as a bonus rather than a substitute for experience 7–12 years across GRC, security compliance, or audit, including full ownership of at least two SOC 2 Type II cycles #J-18808-Ljbffr Pallet