SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Scribe is a specialized intelligence platform used by 94% of the Fortune 500 to capture and operationalize how work happens. The company has grown from 1M to 100M ARR in under four years with fewer than 200 employees, serving 7 million users across 600,000 businesses. As Information Security & GRC Manager, you will be the hands-on owner of Scribe's security and compliance program, reporting to the Head of Legal.
Key Responsibilities:
- Execute and operate Scribe's SOC 2 Type II program end-to-end, including control ownership, evidence collection, auditor management, and gap closure. Support additional compliance frameworks as customer demand requires.
- Own enterprise customer security reviews: complete security questionnaires, maintain the trust center and security documentation, lead security calls with Sales, Customer Success, and Legal.
- Provide technical security input on customer contracts (MSAs, DPAs, BAAs, AI terms) and flag non-standard requests for leadership decision.
- Maintain the risk register, security policies, and vendor security review process. Escalate risks to leadership with clear recommendations and prioritization.
- Convert audit findings, control requirements, and security issues into concrete engineering work and track completion.
- Operate and scale core internal security programs: access reviews, security awareness training, endpoint and device management, vulnerability management, and incident response readiness.
The role is critical to Scribe's scaling: without it, audits slip, security questionnaires pile up, enterprise deals stall, and compliance requirements never translate into engineering work.
Requirements:
- 6+ years of information security, GRC, or security compliance experience at a SaaS or technology company.
- 2+ years managing individual contributors.
- Hands-on experience running SOC 2 Type II audits (as the primary executor, not occasional contributor).
- Demonstrated experience handling enterprise customer security reviews and questionnaires alongside Sales, Customer Success, and Legal.
- Working knowledge of cloud security, identity and access management, endpoint security, and vulnerability management sufficient to engage credibly with engineers and drive remediation.
- Familiarity with GRC automation platforms (e.g., Vanta, Drata, Secureframe).
- Sound judgment about risk prioritization and escalation.
- Strong organization, follow-through, and ability to work independently with limited team support.
- Experience with information security and privacy frameworks including ISO 27001, HIPAA, FERPA, public-sector requirements, and AI governance frameworks (e.g., EU AI Act, ISO 42001).
- CISSP, CISM, or CISA certification preferred.
