SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Scribe is a specialized intelligence platform used by 94% of the Fortune 500 to capture and operationalize how work happens. The company has grown to 7 million users across 600,000 businesses since 2019, is valued at over $1B, and is backed by leading investors.
As Information Security & GRC Manager, you will be the hands-on owner of Scribe's security and compliance program, reporting to the Head of Legal. This is a critical role: if unfilled, audits slip, security questionnaires pile up, enterprise deals stall, and compliance requirements never translate into engineering work.
Key responsibilities include:
- Run SOC 2 Type II program end-to-end: control ownership, evidence collection, auditor management, gap closure, and support for additional frameworks as customer demand requires.
- Own customer security reviews: complete questionnaires, maintain trust center and security documentation, lead security calls with Sales, Customer Success, and Legal.
- Provide technical security input on customer contracts (MSAs, DPAs, BAAs, AI terms) and flag non-standard requests for leadership decision.
- Maintain risk register, security policies, and vendor security review process; escalate risks with clear recommendations and prioritization.
- Convert audit findings, control requirements, and security issues into concrete engineering work and track to completion.
- Operate and scale core internal security programs: access reviews, security awareness training, endpoint and device management, vulnerability management, and incident response readiness.
You'll work in a fast-growing SaaS environment where scope expands with impact. The company went from $1M to $100M ARR in under four years with fewer than 200 people. Customers include T-Mobile, LinkedIn, HubSpot, New York Life, and Northern Trust.
The role is hybrid, based in San Francisco, with 3 days per week in office (Mondays and Wednesdays as anchor days).
REQUIREMENTS:
- 6+ years of information security, GRC, or security compliance experience at a SaaS or technology company, with 2+ years managing individual contributors.
- Hands-on experience running SOC 2 Type II audits (as the primary executor, not occasional contributor).
- Experience handling enterprise customer security reviews and questionnaires alongside Sales, Customer Success, and Legal.
- Working knowledge of cloud security, identity and access management, endpoint security, and vulnerability management sufficient to engage credibly with engineers and drive remediation.
- Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe).
- Sound judgment about risk prioritization and escalation.
- Strong organization, follow-through, and ability to work independently with limited team support.
- Experience with information security and privacy frameworks including ISO 27001, HIPAA, FERPA, public-sector requirements, and AI governance frameworks (e.g., EU AI Act, ISO 42001).
- CISSP, CISM, or CISA certification preferred.
Not a fit if: you lack experience scaling security at a global SaaS company, haven't personally executed commercial negotiations or audit/remediation work, treat all findings as requiring maximum mitigation regardless of business context, or need a fully defined playbook (the program is still maturing).
