GRC Principal (Data Privacy and Security)

Join Wrapbook as a Principal GRC Manager, where you will lead the privacy and security GRC programs. This high-autonomy role requires a strong background in building and maturing GRC programs in fintech or SaaS companies. You will drive the strategic direction and own the execution of GRC activities, leveraging AI to enhance your output. Your responsibilities will include leading the annual SOC 1 and 2 audit lifecycle, evolving Wrapbook's ISMS policy suite, maturing vendor risk management, and building and evolving the privacy compliance program. You will also serve as a subject-matter authority and trusted advisor on security and privacy governance and compliance topics.

• Lead and mature Wrapbook's privacy and security Governance, Risk, and Compliance (GRC) programs, setting the multi-year direction for GRC investment.
• Oversee the annual SOC 1 and 2 audit lifecycle, control monitoring, and work with auditors to complete the audit project and reporting.
• Collaborate with Legal and Security teams to build and evolve Wrapbook’s Data Governance program across the data lifecycle, and build and evolve the privacy compliance program across GDPR and CCPA.

• You are a bridge-builder, you know how to develop, grow, and leverage strong relationships and trust with cross-functional stakeholders and leadership
• You thrive on systems-thinking and delivering measurable results with rigor; you’ll own the project management, frameworks, measurement, outward and upward reporting, influence executives and leaders
• You have a proven track record of building AI-first solutions for traditional GRC problems; you have the expertise and experience to validate AI outputs
• You’ll evolve a program that passes SOC 1 and SOC 2 Type II audits, moving it from "successful audits" to durable, continuously audit-ready operational maturity
• Exceptional cross-functional influence — able to move executives and technical teams without direct authority
• Deep, hands-on expertise across security (SOC 2 / ISO 27001 / PCI DSS), privacy (GDPR / CCPA, DSAR operations, data governance) compliance
• Working fluency in AI/ML governance and the current regulatory landscape. You are comfortable with setting policy where standards are still forming
• Proven experience leveraging AI to automate GRC workload and force-multiply GRC programs to measurable outcomes
• 10+ years in GRC, information security and privacy compliance with a track record of building, scaling, and operating highly rigorous programs — ideally at a fintech, start-up, or payments organization
• Demonstrated ownership of SOC audit lifecycles and enterprise risk and third-party risk programs
• Relevant certifications a plus: CISSP, CISA, CISM, CRISC, CIPP/CIPM/CIPT, and/or AIGP
• Project management is second nature, you effectively establish, track, measure and communicate/report out on cross-functional program progress, prioritization decisions/trade-offs, risks, and impact
• You have the highest integrity and discretion. ****Customer trust is paramount at Wrapbook and this role will interact with highly sensitive data, owning difficult risk trade-offs with sound ethics and confidentiality