Governance, Risk & Compliance
Head of Governance, Risk & Compliance (GRC) Recruiting
Owns security policy, risk management, audits and certifications such as SOC 2, ISO 27001 and FedRAMP.
About the role
The Head of GRC makes sure the security program is documented, measured and able to stand up to audits, customers and regulators. They own policies, the risk register, third-party risk, and the certifications that often decide whether a company can close enterprise deals.
Modern GRC leaders automate evidence collection and turn compliance into a business asset. We look for people who reduce audit effort and make trust a selling point, not just a checkbox.
Typical responsibilities
- Own security policies, standards and the risk management program
- Lead audits and certifications such as SOC 2, ISO 27001, PCI DSS, HIPAA or FedRAMP
- Run third-party and vendor risk management
- Support sales with security questionnaires and customer trust requests
- Report risk posture and compliance status to leadership
What we assess in candidates
- Direct ownership of the frameworks your business needs
- Experience with GRC automation platforms
- Risk quantification and executive reporting
- Ability to support sales and customer trust
How we search for a Head of GRC
We match candidates to your regulatory and customer requirements, whether that is SOC 2 for a SaaS company, FedRAMP for a government supplier or financial services regulation. Interviews cover audits they led and how they reduced the effort behind them.
Frequently asked questions
When should a company hire a dedicated GRC leader?
Typically when audits, certifications and customer security reviews start taking real time from engineers and leadership, or before pursuing a new certification.
Do GRC leaders need technical skills?
Enough to understand the controls they are assessing and talk credibly with engineers. Strong GRC leaders often come from audit, consulting or security engineering backgrounds.
Related functions
Start a search
Looking for a Head of GRC?
Tell us about the role and the team. We will reply within one business day.