GRC Analyst

Superhuman offers a dynamic hybrid working model for this role. This flexible approach gives team members the best of both worlds: plenty of focus time along with in-person collaboration that helps foster trust, innovation, and a strong team culture.

About Superhuman

Superhuman is an AI productivity suite that makes AI work for everyone. Over 40 million people rely on it daily to get work done. A recognized leader in productivity tools, Superhuman is the maker of popular products including Docs, Fathom, Go, GPTZero, Grammarly, and Mail. The newest product, Superhuman Go, builds on Grammarly’s ability to deliver help everywhere people work. It lets anyone build proactive agents that act as teammates across more than 1 million apps and websites, without changing how they work. Learn more at superhuman.com.

The Opportunity

You’ll help run Superhuman’s unified audit program: quarterly audit activities across SOC 2, the ISO 27000 family, ISO 42001, and our other certifications. You’ll work with our audit firms, GRC Partners, and control owners across Superhuman, and plan new audits as we expand to new frameworks, platforms, and regions. You’ll also run gap assessments that show what each expansion will take before we commit.

You’ll build the audit operating model and runbook, and drive automation so evidence can be collected and reused across frameworks where possible, requests to control owners are streamlined, and each audit cycle takes less effort than the last. Building with AI tools is a normal part of the job, with appropriate human oversight.

This is an individual contributor role for a program manager who communicates clearly, manages competing priorities, and enjoys simplifying complex processes.

Key responsibilities

• Run the audit program as one program: an integrated plan and calendar across audits and expansions, with milestones, dependencies, risks, and decisions tracked, and regular status updates to GRC leadership and stakeholders.

• Plan and run quarterly audits from scoping through report and findings closeout, including readiness ahead of each fieldwork window (control owner prep, evidence pre-checks, walkthrough dry runs).

• Scope each audit’s boundary with Product and Engineering, and flag when a launch or new platform changes it.

• Build and maintain the audit operating model and runbook as the program grows.

• Drive automation of evidence collection, request tracking, and audit reporting. Work with GRC Engineering on new ways to generate and collect evidence, and reuse evidence and walkthroughs across frameworks where applicable.

• Partner with GRC and Procurement on third-party risk management across the vendor lifecycle.

• Align audit windows across frameworks and firms to minimize duplicate evidence requests to control owners.

• Plan new audits and expansions, and run framework and scope evaluations and gap assessments with recommendations and effort estimates leadership can act on.

• Work with control owners and GRC Partners to deliver evidence and close findings, and coordinate with GRC Partners on findings requiring extended remediation.

• Manage day-to-day auditor relationships, and report audit status, findings, and program metrics to GRC leadership.

Minimum qualifications

• 5+ years of program management experience running multi-workstream programs with plans, milestones, dependencies, risk tracking, and leadership reporting.

• 5+ years running external security audits (SOC 2 and ISO 27001 at minimum), at a company or an audit firm, including seasons with several frameworks at once.

• Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and PCI-DSS and where their requirements overlap.

• Experience leading a gap assessment for a new framework or scope change and presenting the result to leadership.

• Experience building or improving an audit process: calendars, request tracking, runbooks, roles and responsibilities.

• Technical fluency to understand how evidence is produced in cloud environments, assess the completeness and accuracy of system-generated reports, and identify opportunities for automation using AI tools.

• Ability to communicate clearly, manage competing priorities, and proactively resolve blockers during time-sensitive audit cycles.

• Demonstrated ability to influence cross-functional stakeholders, establish accountability, and drive deliverables without direct reporting authority.

Preferred qualifications

• Experience managing complex external audits in an in-house GRC function, consulting environment, or audit firm.

• Familiarity with additional frameworks such as ISO 42001, PCI DSS, ISO 27701 or 27018, CSA STAR, or international schemes (for example, IRAP, ISMAP, or C5).

• Experience automating evidence collection or audit reporting, or using LLMs day-to-day to plan, track, and report on program work.

• Experience with a GRC platform or building lightweight internal tooling.

Compensation and Benefits

Superhuman offers all team members competitive pay along with a benefits package encompassing the following and more:

• Excellent health care (including a wide range of medical, dental, vision, mental health, and fertility benefits)

• Disability and life insurance options

• 401(k) and RRSP matching

• Paid parental leave

• 20 days of paid time off per year, 12 days of paid holidays per year, two floating holidays per year, and flexible sick time

• Generous stipends (including those for caregiving, pet care, wellness, your home office, and more)

• Annual professional development budget and opportunities

Superhuman takes a market-based approach to compensation, so base pay may vary by location. Our US locations are categorized into two compensation zones based on proximity to our hub locations.

For more information about our compensation zones and locations where we currently support employment, please refer to this page. If a location of interest is not listed, please speak with a recruiter for additional information.

We encourage you to apply

At Superhuman, we value our differences, and we encourage all to apply—especially those whose identities are traditionally underrepresented in tech organizations. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, ancestry, national origin, citizenship, age, marital status, veteran status, disability status, political belief, or any other characteristic protected by law. Superhuman is an equal opportunity employer and a participant in the US federal E-Verify program (US). We also abide by the Employment Equity Act (Canada).