SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 235,000 - 317,000 / annual
Figma is seeking a Director of Governance, Risk & Compliance to lead the company's GRC program through its next growth phase. This is a hands-on leadership role that combines strategic program ownership with team management and cross-functional partnership.
You will own Figma's end-to-end security compliance, risk management, and governance strategy. Key responsibilities include:
• Setting the strategic direction and roadmap for the GRC program, aligning compliance, risk, and governance priorities with company objectives and Security leadership
• Owning Figma's certification and compliance portfolio, including SOC 2, ISO 27001, FedRAMP, SOX ITGC, and GDPR, with responsibility to expand coverage as the company enters new markets
• Leading and growing a team of compliance, risk, and governance professionals, developing talent and building a culture of rigor and pragmatism
• Building and evolving enterprise risk and controls frameworks, including AI Governance initiatives and control effectiveness monitoring, that scale across technical and business stakeholders
• Managing relationships with external auditors, assessors, and regulators, overseeing audit cycles from planning through remediation
• Directing selection and optimization of GRC platforms and tooling, maintaining the lifecycle of security policies, standards, and procedures
• Partnering with Sales, Legal, and Customer Trust on security questionnaires, customer audits, contracts, and trust-related communications supporting the sales lifecycle
• Scaling enterprise risk reporting and reporting on program health, risk posture, and audit readiness to executive and board-level audiences
Figma is a design and collaboration platform that helps teams bring ideas to life, from brainstorming through prototyping to code translation and AI-powered iteration. The GRC team is foundational to building and maintaining trust with users, regulators, business partners, and organizations relying on Figma.
This role can be held from one of Figma's US hubs (San Francisco or New York) or remotely within the United States.
REQUIREMENTS:
• 10+ years of experience in information security, compliance, or risk management, including at least 4 years leading or managing a GRC, security, or compliance team
• Deep, hands-on experience with frameworks such as SOC 2 and ISO 27001, including leading programs through multiple audit cycles
• Track record of building GRC programs from the ground up or scaling them through high-growth stages, ideally at a SaaS or platform company, including experience operating in a public company environment with SOX ITGC requirements
• Executive presence and exceptional written and verbal communication skills, with demonstrated ability to build cross-functional partnerships across Security, Legal, IT, Sales, and Engineering and translate technical risk into business terms for executives, the board, and customers
• Experience implementing compliance programs for emerging products, including AI-enabled products, with strong understanding of cloud-based technologies and their GRC implications, and a builder's mindset comfortable with ambiguity as the program scales
PLUS (not required):
• FedRAMP authorization support, SSP development, 3PAO coordination, or continuous monitoring experience
• Global privacy and data protection regulations experience (GDPR, NIS2)
• Security or risk certifications (CISSP, CISA, CISM, CRISC)
• Hands-on GRC platform implementation or administration (Vanta, Drata, or similar)
• Board, steering committee, or audit committee presentation experience
