SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Superhuman (formerly Grammarly, now part of the AI productivity platform) is consolidating compliance programs across four products (Grammarly, Coda, Superhuman Mail, and Superhuman Go) into a single unified program. This role focuses on automating compliance and GRC (Governance, Risk, and Compliance) workflows to replace manual, point-in-time approaches with continuous, automated, code-defined evidence.
You will own the automation architecture for compliance across multiple products rather than maintaining an existing checklist. The core mandate is to retire manual evidence collection using three key tools: a GRC automation platform, agentic AI systems (Claude Code and similar), and compliance-as-code practices in GitHub.
Key Responsibilities:
- Automate evidence collection by configuring the GRC automation platform: wire up data sources, build evidence plugins, scope data sets, author analysis rules, and stand up continuous monitoring operations to replace screenshot-and-upload workflows with automated collectors mapped to controls.
- Automate GRC workflows and run compliance as code using Claude Code (or similar) and MCPs for evidence requests, control mapping, gap analysis, vendor reviews, and reporting. Build and curate the team's agent harness; manage policies, control definitions, and automation in GitHub through branches, pull requests, and code review.
- Design control testing and drive remediation across SOC 2, ISO 27001, ISO 27017/27018, ISO 27701, PCI DSS, and ISO 42001 for continuous assurance rather than point-in-time snapshots. Work with control owners and engineering to close gaps with automated evidence behind every finding.
Ramp-up expectations: Within the first few weeks, you'll configure the GRC automation platform directly. In your first 90 days, you'll learn platform configuration, ship your first automated evidence collectors, retire a batch of manual screenshot evidence, and get at least one agent-assisted workflow running end-to-end.
This is a small team with high ownership and direct access to Legal and Engineering leadership. The team already runs LLMs and AI agents in production GRC workflows today—this is how the program operates day-to-day.
Superhuman offers a hybrid working model with flexibility for focus time and in-person collaboration. The company provides comprehensive benefits including competitive pay, life care (mental health and risk benefits), ample time off, home office setup support, wellness and pet care stipends, learning and development opportunities, and relocation support including visa assistance and a relocation bonus.
REQUIREMENTS:
- 5+ years in compliance, GRC, or IT audit with hands-on experience in SOC 2, ISO 27001, PCI DSS, and adjacent frameworks.
- 1+ year using agentic AI systems (Claude Code, Codex, etc.) to do real compliance work, with delivered automation (not just prototypes).
- Comfortable in GitHub: repos, branches, pull requests, and code review. CI/CD familiarity is a strong plus.
- Fast on new tooling; ability to pick up a GRC automation platform and be productive in weeks, configuring it directly.
- Deep GRC fluency: control design, evidence, risk, and understanding how auditors think.
- Working knowledge of cloud (AWS/Azure/GCP): IAM, compute, storage, networking, and security controls.
- Systems thinker who prefers to automate repetitive manual work.
NICE TO HAVE:
- Comfortable reading APIs, JSON, and logs; scripting experience (Python, bash, TypeScript).
- Prior hands-on experience with a GRC automation platform (Vanta, Drata, or similar).
- Certifications such as CISA, CISSP, ISO 27001 Lead Auditor, or similar.
- AI governance, AI risk management, or ISO 42001 exposure.
- Background in technology, SaaS, or engineering-adjacent environment.
