The ad says“Help shape Wrapbook’s enterprise AI data governance framework in collaboration with our Security and Legal leadership/org— policies, standards, and controls across the AI/ML lifecycle for both internally built and procured AI”
The ad says“Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program”
The ad says“Lead Customer Assurance efforts for enterprise security reviews (e.g., enterprise customer and prospect review requirements, cyber-insurance self-assessments) and scale Wrapbook’s security and privacy documentation and mechanisms”
The ad says“Collaborate with Legal and Security teams to build and evolve Wrapbook’s Data Governance program across the data lifecycle (data collection, storage, access, retention, deletion)”
The ad says“Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program”
The ad says“Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program”
The ad says“Track the evolving regulatory and framework landscape (e.g., NIST AI RMF, ISO 42001, EU AI Act) and translate it into Wrapbook’s needs”
The ad says“Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program”
The ad says“Deep, hands-on expertise across security (SOC 2 / ISO 27001 / PCI DSS), privacy (GDPR / CCPA, DSAR operations, data governance) compliance”
The ad says“Track the evolving regulatory and framework landscape (e.g., NIST AI RMF, ISO 42001, EU AI Act) and translate it into Wrapbook’s needs”
The ad says“Own and evolve Wrapbook’s ISMS policy suite and control framework (SOC 1, SOC 2 Type II; explore additional ISO compliance opportunities) in collaboration with our Business, Legal, and Security teams”
The ad says“Track the evolving regulatory and framework landscape (e.g., NIST AI RMF, ISO 42001, EU AI Act) and translate it into Wrapbook’s needs”
The ad says“Deep, hands-on expertise across security (SOC 2 / ISO 27001 / PCI DSS), privacy (GDPR / CCPA, DSAR operations, data governance) compliance”
The ad says“Partner with Legal on DPAs, subprocessor obligations, and privacy-by-design in product”
The ad says“Project management is second nature, you effectively establish, track, measure and communicate/report out on cross-functional program progress, prioritization decisions/trade-offs, risks, and impact”
The ad says“Lead the annual SOC 1 and 2 audit lifecycle end-to-end: control monitoring/readiness, work with our SOC auditors and internal business teams to complete the audit project and reporting supporting evidence collection and clarification process, drive control-owner accountability and lead program development to embed continuous, evidence-driven controls”
The ad says“Lead the annual SOC 1 and 2 audit lifecycle end-to-end: control monitoring/readiness, work with our SOC auditors and internal business teams to complete the audit project and reporting supporting evidence collection and clarification process, drive control-owner accountability and lead program development to embed continuous, evidence-driven controls”
The ad says“Mature our approach to vendor risk management, developing and evolving the program, frameworks, prioritization, stakeholder management, and measurement”
Values
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
The ad says“Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP”
We’re hiring a Principal GRC Manager (Individual Contributor) to serve as a subject matter expert and technical authority leading Wrapbook’s privacy and security GRC programs
This is a high-ambiguity, high-autonomy role for someone who has built and matured GRC programs at a fintech or SaaS company from the ground up
This person will not just maintain grc activities, but bring a strong point of view to set the multi-year direction for how Wrapbook manages GRC investment on the security and privacy front as our AI capabilities expand
This person is both excited to drive the strategic direction and own the ground-level execution across their areas, leveraging AI to amplify their output
You understand the difference between checking boxes and high judgment decisions, you focus on outcomes over activity
You cleanly separate the must-dos and the nice-to-haves informed by a business’ risk appetite, industry context, and overall company objectives
Data Security GRC
Lead the annual SOC 1 and 2 audit lifecycle end-to-end: control monitoring/readiness, work with our SOC auditors and internal business teams to complete the audit project and reporting supporting evidence collection and clarification process, drive control-owner accountability and lead program development to embed continuous, evidence-driven controls
Own and evolve Wrapbook’s ISMS policy suite and control framework (SOC 1, SOC 2 Type II; explore additional ISO compliance opportunities) in collaboration with our Business, Legal, and Security teams
Mature our approach to vendor risk management, developing and evolving the program, frameworks, prioritization, stakeholder management, and measurement
Lead Customer Assurance efforts for enterprise security reviews (e.g., enterprise customer and prospect review requirements, cyber-insurance self-assessments) and scale Wrapbook’s security and privacy documentation and mechanisms
Data Privacy GRC
Collaborate with Legal and Security teams to build and evolve Wrapbook’s Data Governance program across the data lifecycle (data collection, storage, access, retention, deletion)
Beyond project management you will make recommendations and own decisions on how to best solve Wrapbook’s dynamic and growing data governance challenges
Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program
Partner with Legal on DPAs, subprocessor obligations, and privacy-by-design in product
Help shape Wrapbook’s enterprise AI data governance framework in collaboration with our Security and Legal leadership/org— policies, standards, and controls across the AI/ML lifecycle for both internally built and procured AI
Track the evolving regulatory and framework landscape (e.g., NIST AI RMF, ISO 42001, EU AI Act) and translate it into Wrapbook’s needs
Cross-functional leadership
Executive fluency and credibility. Translates technical and regulatory risk into business terms leadership can act on, and holds their own in front of executives, auditors, and enterprise customers. Trusted to represent Wrapbook’s risk posture externally
Serve as the subject-matter authority and trusted advisor on Security and Privacy governance and compliance topics
Mentor cross-functional partners and team members and set the standard for the discipline across the org
Benefits
401K & RRSP
IT Setup for Your Home
Work Remotely
Stock Options
Parental Leave
Health & Benefits - choose from several customizable plans, including vision and dental
Minimum Time Off - Everyone is encouraged to take at least 3 weeks off annually
Lifestyle Perks - Wrapbook employees get a monthly stipend to treat themselves
Preferred experience
You are a bridge-builder, you know how to develop, grow, and leverage strong relationships and trust with cross-functional stakeholders and leadership
You thrive on systems-thinking and delivering measurable results with rigor; you’ll own the project management, frameworks, measurement, outward and upward reporting, influence executives and leaders
You have a proven track record of building AI-first solutions for traditional GRC problems; you have the expertise and experience to validate AI outputs
You’ll evolve a program that passes SOC 1 and SOC 2 Type II audits, moving it from “successful audits” to durable, continuously audit-ready operational maturity
Exceptional cross-functional influence — able to move executives and technical teams without direct authority
Deep, hands-on expertise across security (SOC 2 / ISO 27001 / PCI DSS), privacy (GDPR / CCPA, DSAR operations, data governance) compliance
Working fluency in AI/ML governance and the current regulatory landscape. You are comfortable with setting policy where standards are still forming
Proven experience leveraging AI to automate GRC workload and force-multiply GRC programs to measurable outcomes
10+ years in GRC, information security and privacy compliance with a track record of building, scaling, and operating highly rigorous programs — ideally at a fintech, start-up, or payments organization
Demonstrated ownership of SOC audit lifecycles and enterprise risk and third-party risk programs
Project management is second nature, you effectively establish, track, measure and communicate/report out on cross-functional program progress, prioritization decisions/trade-offs, risks, and impact
You have the highest integrity and discretion. **Customer trust is paramount at Wrapbook and this role will interact with highly sensitive data, owning difficult risk trade-offs with sound ethics and confidentiality
