SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
OpenAI's Governance, Risk, and Compliance team is seeking a technical, product-minded GRC builder to own consequential audits while improving the control and evidence systems behind them. This role bridges security, engineering, infrastructure, product, privacy, and legal functions to make controls provable, risk decisions explicit, and audit readiness a natural outcome of well-designed systems.
You will lead external, internal, customer, and certification audit work from scoping through evidence review, fieldwork, remediation, and closeout. A core responsibility is building a reusable common control framework that links risk, control intent, implementation, ownership, system scope, evidence, and applicable frameworks (SOC 2, ISO 27001/27017, PCI DSS, NIST, FedRAMP). Rather than inheriting assumptions, you'll validate actual scope and ownership, ensuring controls and product boundaries remain accurate.
The role emphasizes automation and technical leverage. You'll use Codex and comparable AI-assisted development tools to build and test evidence checks, control mappings, request triage, owner workflows, monitoring, and remediation reporting. You'll partner closely with engineers on cloud architecture, identity, logging, data flows, software changes, vulnerabilities, and control effectiveness. You'll design maintainable, permission-aware tools that preserve source provenance, human review, and evidence integrity.
Success means reducing repeated requests and operational burden for control owners through measurable workflow improvements. You'll define roadmaps, decision rights, milestones, success metrics, and clear cross-functional escalations.
Required qualifications include direct ownership of meaningful audit, security, customer-assurance, or regulatory outcomes; practical knowledge of control design, evidence, testing, operating effectiveness, and remediation; technical fluency across cloud systems, identity, logging, APIs, data flows, and system boundaries; and ability to use code, SQL, APIs, structured data, automation, or data workflows to solve operational problems. You should be able to design reusable cross-framework controls without erasing framework-specific requirements, bring first-principles curiosity and creative problem-solving, and demonstrate clear partnership with cross-functional teams. Specific certifications or prior access to OpenAI tools are not required.
