GRC Manager at G2 · LumiJobs

Responsibilities

Summary of Responsibilities:
The Governance, Risk, and Compliance (GRC) Manager owns G2's day-to-day security compliance and risk program, and is the senior operator responsible for keeping our customer trust commitments, audit obligations, and risk posture on track. This role runs a high-volume operation: customer security questionnaires, vendor risk reviews, policy governance, DSAR processing, audit management, and risk register maintenance. This manager is expected to bring the judgment to prioritize competing demands, the process discipline to scale a growing workload, and the maturity to represent G2 directly to customers, auditors, and executive stakeholders.
This is a senior individual-contributor role. Success depends on the ability to work as a trusted partner across the business: Legal, Security Engineering, IT, Sales, and executive leadership all rely on this person to move their goals forward, whether that's closing a deal that's stuck on a security questionnaire, unblocking an audit finding, or getting a policy approved. The ideal candidate has run a GRC program at this scale before: comfortable working inside modern compliance tooling (e.g., Vanta), fluent in SOC 2 Type II and ISO 27001, and experienced translating technical risk into business language for both customers and leadership.
Detailed Responsibilities:
Own and administer G2's security policy library (35+ documents), leading the annual review cycle, managing approvals, and ensuring no policy lapses past its renewal date.
Lead response to customer and prospect security questionnaires — from short-form intake to 100+ question enterprise reviews — and maintain the security knowledge library that powers fast, accurate answers at scale.
Own G2's public Trust Center and serve as the company's front-line representative to customers and partners on security and compliance matters.
Run the third-party/vendor risk management program, reviewing AI-assisted vendor risk assessments, making final risk-level determinations, and driving remediation of high-risk findings.
Manage data subject access request (DSAR) intake and fulfillment, ensuring requests are documented and resolved within regulatory timelines.
Support security addendum and contract redlines, partnering with Legal and counterparties through multiple negotiation rounds to close terms.
Maintain and mature enterprise risk registers across business functions, driving treatment plans, control linkage, and quarterly reassessment to closure.
Lead SOC 2 Type II and ISO 27001 audit cycles end-to-end — evidence collection, control testing, and serving as primary point of contact for auditors.

GRC Manager

Responsibilities

Qualification

Required

Company

G2

More roles at G2