SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Suno is building the world's first creative entertainment platform for music creation, backed by leading investors including Bond Capital, Menlo Ventures, Lightspeed Venture Partners, and NVIDIA's venture arm. The company is the fastest-growing consumer entertainment company and leader in AI music.
You will build Suno's security compliance program from the ground up as a Staff Security GRC Analyst, reporting directly to the CISO. This is a greenfield opportunity with real stakes and direct access to leadership.
Key responsibilities:
- Build and own Suno's security control framework, mapping controls to SOC 2, NIST CSF, and future frameworks, and writing control descriptions with the teams who run them.
- Lead SOC 2 preparation end-to-end, from gap assessments and readiness tracking to driving remediation with control owners and coordinating with external auditors.
- Automate evidence collection and control monitoring using scripts, integrations, and AI tools, determining where human review remains necessary.
- Run vendor security reviews, maintain current security policies, and answer customer security questionnaires in partnership with Product and Legal teams.
- Partner with the CISO to provide leadership and the board with clear, evidence-backed views of security posture and lay foundations for GRC as the Security team grows.
- Help earn trust from partners and customers who expand Suno's reach.
You'll work alongside AppSec and InfraSec teams, comfortable reading cloud configurations and audit standards alike, and preferring to automate evidence collection with AI rather than chase manual screenshots.
REQUIREMENTS:
Must-haves:
- 7–9 years in GRC, security compliance, or IT audit.
- Hands-on, end-to-end ownership of a security compliance program as its primary owner, ideally including taking a company through its first SOC 2.
- Deep working knowledge of SOC 2 and NIST CSF, including control mapping, audit mechanics (design vs. operating effectiveness, sampling, evidence), and staying current as requirements evolve.
- Enough technical fluency to read a cloud configuration, access setup, or pipeline and judge whether it enforces what the control says. Production coding skills not required.
- Comfort building your own automation with scripts or AI tools.
Nice-to-haves:
- Experience standing up continuous controls monitoring or automated evidence collection, including what it covered and what changed as a result.
- Experience applying LLMs to assurance work, such as control drafting, framework mapping, or evidence testing.
- Experience with cloud environments such as AWS or GCP, and with a modern GRC platform.
- Certifications such as CISA, CISSP, or CRISC.
