Director of GRC

About San Francisco Compute San Francisco Compute exists to give ambitious teams large scale supercomputers without taking on a catastrophic balance sheet risk. Most GPU clouds force you to sign long term contracts with no way out. If you underbuy, you miss the window. If you overbuy, you’ll blow up with no way out. It’s a desperate gamble that San Francisco Compute does not force you to play. About San Francisco Compute San Francisco Compute exists to give ambitious teams large scale supercomputers without taking on a catastrophic balance sheet risk. Most GPU clouds force you to sign long term contracts with no way out. If you underbuy, you miss the window. If you overbuy, you’ll blow up with no way out. It’s a desperate gamble that San Francisco Compute does not force you to play. Originally, SFC was an AI lab that bought too big of a GPU cluster and was forced to sublease it or go under. Today, we build data centers, supercomputers, and then lease those machines on contracts that let our customers sublease. More than anyone else in the industry, we deeply felt the pain and fear of being forced to bet the farm with your neocloud vendor. To make it possible to sublease, we invented the first compute market and became the first one to offer physical settlement. That means we operate GPU clusters like a neocloud and derisk our customers like a market. Customers buying GPU clusters don’t want to work through a network of brokers. They want to transact with the folks that have the keys to the cluster and can own the SLA. To keep the industry safe from unnecessary risk, SFC needs to scale fast. To do that, we serve financially motivated parties as a technical partner to build, operate, & lease supercomputers on their behalf. Basically, we help folks who want an economic return build GPU clusters on their balance sheet, but operated in full by us. That allows us to retain the technical control needed to operate a cloud, but scale fast like a market. SFC’s ability to offer subleasing can significantly increase the levered returns for cluster owners. Our hybrid model out-performs brokered contracts or other “compute markets”, who have to go through a network of counterparties to solve problems. It also lets us design custom solutions for our customers, like clusters deployed in regions next to your dataset or physical eval set or a large CPU fleet deployed colocated with your GPU cluster. Our team includes senior & technical leadership from places like Lambda, Crusoe, Digital Ocean, AWS, and Hut8. Our CTO is the cofounder and former CEO of Voltage Park. In prior roles, our team has deployed 8GW of datacenter capacity & hundreds of thousands of GPUs. We’ve been described as having “the highest talent density in the space.” If you are an honorable, gritty person with eyes wide open & good epistemics, who wants to see AI go right, we’d love to work with you. There has never been a more critical moment in history and it is up to us to shape it on behalf of those who come after us. About The Role As Director of GRC, you'll own governance, risk, and compliance at SFCompute and build the team that runs it - starting with you as the first hire. We've completed our first SOC 2 audit and are pursuing ISO 27001 next. These two - maintaining SOC 2 and obtaining ISO 27001 - are the committed mandate. Reporting to engineering leadership, you'll set the function's strategy and operating cadence, hire and manage a small GRC team, and personally build and drive the program of work from day one - designing controls, running the tooling, and managing auditors yourself until the team is in place to take it on. Much of what your team will run doesn't exist yet - the mandate is to design new functions and processes, not inherit them. This is a build role. You should have prior startup experience in a high-impact, senior capacity, and you should have personally taken a company through an ISO 27001 certification for the first time - not just maintained one that was already in place. About You Prior experience in a senior, high-impact GRC or security compliance role at a startup - you've built programs under resource constraints, not just operated within an already-mature function. Hands-on experience driving a company through its first ISO 27001 certification, from readiness through audit - standing up the program, not inheriting one already in place. Experience owning or running a SOC 2 program. Proven people leadership - you've hired, managed, and developed a team before. Comfortable working cross-functionally with engineering on controls, tooling, and technical remediation. Responsibilities Team Leadership: Hire, manage, and develop the GRC team from day one - set its structure, priorities, and operating cadence, and own its results. Compliance Program Ownership: Own our SOC 2 Type 2 program and lead ISO 27001 certification end to end - readiness, gap remediation, control implementation, auditor management, and continuous monitoring. Risk Management: Stand up enterprise risk management - risk assessments, the risk register, treatment plans, and reporting to leadership. Policy & Process Design: Author and operationalize the policies and functions a maturing company needs: access reviews, business continuity, security awareness, and vendor management. Collaborate with departments to ensure change management and incident response policies are sensible and meet compliance obligations. GRC Tooling: Own our compliance automation platform, Vanta, and drive selection and integration of GRC-related tooling. Third-Party Risk: Own vendor security reviews and third-party risk assessments. Nice to Haves Hold relevant certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Implementer/Auditor. Have operated compliance automation platforms (Vanta or similar). Have privacy program experience (GDPR/CCPA). Benefits Generous equity grant Team members are offered a competitive salary along with equity in the company Visa Sponsorships Yes, we sponsor visas and work permits Retirement matching We match 401(k) plans up to 4% Medical, dental & vision We offer competitive medical, dental, vision insurance for employees and dependents and cover 100% of premiums Time off We offer unlimited paid time off as well as 10+ observed holidays Parental leave We offer biological, adoptive, and foster parents paid time off to spend quality time with family Daily lunch We cover lunch daily for employees Unlimited office book budget You can buy as many books for the office as you want The San Francisco Compute Company is committed to maintaining a workplace free from discrimination and harassment. We make employment decisions based on business needs, job requirements, and individual qualifications, without regard to race, color, religion, belief, national origin, social or ethical origin, age, physical, mental, or sensory disability, sexual orientation, gender identity or expression, marital status, civil union or domestic partnership status, past or present military service, HIV status, family medical history or genetic information, family or parental status including pregnancy, or any other status protected by law. We welcome the opportunity to consider qualified applicants with prior arrest or conviction records. Our commitment to diversity includes hiring talented individuals regardless of their criminal history, in accordance with local, state, and federal laws, including San Francisco’s Fair Chance Ordinance and California’s ban-the-box laws. #J-18808-Ljbffr San Francisco Compute Company