GRC Lead

About Hightouch

Hightouch is an Agentic Marketing Platform powered by the industry-leading Composable CDP. With complete brand context, customer data, and performance history in one place, every marketer finally has the power to build and ship end-to-end campaigns themselves. Teams move faster, stay on brand, and get AI marketing that actually works.

Founded in 2019 and headquartered in San Francisco, Hightouch enables marketing teams to analyze performance, brainstorm ideas, and generate creative at a speed and quality that wasn't previously possible.

Named a Leader in the 2026 Gartner® Magic Quadrant™ for Customer Data Platforms, Hightouch is trusted by leading enterprises like Domino's, Spotify, Aritzia, Cars.com, Ramp, and PetSmart.

At Hightouch, our mission is to help our customers leverage data and AI to grow their businesses. The team is ambitious, impact-driven, efficient — and we believe humility, kindness, and compassion are essential to our success. If you're energized by velocity, obsessed with raising the bar, and want to build alongside people who care deeply about each other and our customers, we'd love to meet you.

About the Role

We’re hiring our first dedicated GRC Lead to own customer security assurance and our compliance program. Your first priority will be making customer security reviews fast and accurate, alongside ownership of audits, compliance obligations, and risk follow-through.

We build quickly, and this role requires someone who can keep pace. You’ll understand the risks behind customer requirements, make practical recommendations, and drive decisions through to completion. You’ll have substantial autonomy and work directly with engineering, security, IT, legal, and our customer-facing teams.

We’re open to experienced individual contributors, managers who enjoy hands-on work, and people looking to grow into management. You’ll initially handle questionnaires, customer conversations, and audits directly, using AI and automation to increase what a small team can accomplish. As the function grows you’ll be able to grow with it.

What You’ll Own

• Customer security reviews. Own questionnaires, due diligence, and customer security calls. Use AI to accelerate research and drafting, apply your own judgment to ensure precision, and resolve unfamiliar questions with the right technical experts.

• Practical risk decisions. Help teams work through customer security requirements, vendor concerns, and compliance gaps. Understand what’s at stake, bring the right people together, and make sure decisions have clear owners and follow-through.

• Reliable security answers. Maintain approved responses and supporting evidence. Use AI to surface inconsistencies and outdated information, and ensure answers accurately reflect differences across products, configurations, and planned capabilities.

• Compliance strategy and audits. Own our SOC 2 and ISO 27001 programs, set priorities for external partners, assess their work, and close gaps. Ensure controls remain effective between audits, reuse controls across frameworks, and automate evidence collection. Evaluate new programs based on customer demand, the markets we want to enter, and the cost to implement and maintain them.

• Execution and follow-through. Track commitments and remediation with clear owners and deadlines. Build automation and self-service resources that reduce repetitive work, and turn recurring customer questions into improvements to documentation, controls, and product.

About You

You’ve personally owned a compliance program or major audit cycle, and have hands-on experience with customer security reviews.

You bring:

• Judgment. You can describe tradeoffs you’ve made, the risks you accepted or escalated, and why those decisions were reasonable.

• Technical curiosity. You dig into how systems work and can discuss data flows, access controls, cloud infrastructure, and data storage with engineers.

• AI fluency and attention to detail. You build AI-assisted workflows and catch convincing but unsupported answers. You know which details materially change a claim and how to verify them.

• Clear writing and credible customer communication. You explain our security posture accurately, including when the answer is complicated or a capability doesn’t yet exist.

• Ownership and urgency. You make progress with incomplete information, communicate clearly, and close loops without repeated prompting.

• A builder’s approach. You’ve simplified a process, automated recurring work, or found a faster way to satisfy a requirement—and can explain the result.