We are seeking a skilled and experienced Cyber GRC Lead to join Alice (Formerly ActiveFence) CISO team. The ideal candidate will be responsible for driving the security initiatives.
Lead the end to end Operational TPRM lifecycle, assessing and continuously monitoring the security postures of vendors, SaaS platforms, AI tool providers.
Establish risk criteria for third party tools, ensuring third party AI integrations do not introduce data leakage, or intellectual property risks.
Design and manage the enterprise wide security awareness and training program using modern platforms.
Conduct targeted phishing simulations, role based security training and specialized training among others on GenAI risks (prompt injection, shadow AI, data exposure).
Manage and streamline the end to end customer security assessment process (DDQs, RFPs, Security Questionnaires, customer audits).
Build and maintain a centralized, automated knowledge base to expedite responses, directly removing friction from sales velocity and supporting enterprise revenue goals.
Risk Management Frameworks & Risk Advisory:
Lead ongoing security risk assessments, maintaining a dynamic Risk Register mapped to real world business impacts.
Provide continuous risk advisory services across business units, establishing risk treatment and mitigation plans that balance operational agility with guardrails.
GRC Automation & Continuous Compliance:
Architect and leverage high-level GRC automation tools to move from point in time audits to continuous control monitoring.
Drive process automation for evidence collection, vendor assessments, and policy management to reduce manual overhead across technical teams.
Compliance, Frameworks & AI Governance:
Maintain core information security certifications (ISO 27001, SOC 2 Type II, etc)
Build, operationalize, scale the organization's AI Governance Framework, referencing established benchmarks (NIST AI RMF, ISO/IEC 42001).
Lead internal and external audit readiness, acting as the primary liaison for independent auditors.
Close Collaboration with Legal, Privacy & DPO:
Partner directly with Legal and Privacy teams to operationalize global data protection standards (GDPR, CCPA, EU AI Act) align security controls with contractual commitments.
Requirements
Professional Experience:
4+ years of hands on experience in Cyber GRC, IT audit, or security consulting within global, fast paced technology companies.
Proven track record of owning SOC 2 Type II and ISO 27001 compliance lifecycles.
Direct experience partnering with Legal and Privacy teams on GDPR compliance and privacy risk assessments.
Demonstrated track record handling customer DDQs, vendor security reviews (TPRM), and managing security awareness platforms.
Technical, Automation & AI Capabilities:
Strong technical proficiency in utilizing GRC automation platforms to automate control testing, evidence gathering, and vendor workflows.
Working knowledge of cloud security (AWS/GCP/Azure), AI/ML operational risks
Deep familiarity with core frameworks: NIST CSF, ISO 27001, NIST AI RMF, ISO 42001.
Leadership & Stakeholder Management:
Exceptional communication and negotiation skills, capable of translating complex security and compliance demands into clear business terms
A pragmatic, business first mindset focused on designing guardrails that empower teams rather than introducing operational roadblocks.
Fluent in professional English (written and verbal).
Nice to have
Industry certifications: CISA, CRISC, CISM, CISSP, CIPP/E, or IAPP AIGP.
Experience with automated TPRM and vendor intelligence solutions
Practical scripting capabilities to custom build or tie together GRC automation workflows.
About Alice
Alice is a trust, safety, and security company built for the AI era. We safeguard the communicative technologies people use to create, collaborate, and interact—whether with each other or with machines.
In a world where AI has fundamentally changed the nature of risk, Alice provides end-to-end coverage across the entire AI lifecycle. We support frontier model labs, enterprises, and UGC platforms with a comprehensive suite of solutions: from model hardening evaluations and pre-deployment red-teaming to runtime guardrails and ongoing drift detection.