Staff GRC Specialist

Blitzy is a Cambridge, MA based AI software development platform on a mission to revolutionize the software development life cycle by autonomously building custom software to unlock the next industrial revolution. We're transforming how enterprises build software, turning enterprise requirements into enterprise grade code with an agentic software development platform that can autonomously execute 80% of the quantum of software development work.

Our Culture

• Who we are: Led by two pioneering co-founders we are one of the fastest growing companies in the U.S., creating our own category of enterprise autonomous software development. We automate thousands of hours of software development for our customers, which includes strong representation within the Fortune 500.
• How we work: We move Blitzy Fast: Time is both our company’s and our clients’ most precious asset. We move quickly and decisively to innovate internally and deliver exceptional software externally.
• Championship Mindset: We operate like a professional sports team. We win as a team by holding ourselves and each other to high standards, collaborating in-person, and remaining focused on the mission.
• Passion for Invention: We’re pushing the frontier of what’s possible, requiring constant innovation and iteration.
• We Work for the Customer: We focus on delivering outsized value to the customers we work with and expanding those relationships into deep, meaningful partnerships.

About the Role

We're looking for a Staff GRC Specialist to join our GRC team and help run a compliance program that's audit-ready by design, not by scramble. In this role, you'll partner with the Head of GRC to own execution of our existing SOC 2 Type II and ISO 27001 and any future programs end to end, operate Vanta as our system of record, and lead our day-to-day work with internal stakeholders, auditors and compliance partners. You'll work closely with engineering to cut the interrupt load of security questions and evidence requests, and you'll help teammates do the same. You'll also have the opportunity to design the compliance processes that don't exist yet and to help drive our FedRAMP effort, one of the most demanding compliance programs a company can pursue.

Responsibilities

• Lead core compliance assurance programs, including SOC 2 Type II and ISO 27001:2022 readiness end to end, building continuously toward a well executed and low stakeholder impact audit program.
• Manage auditor and partner relationships directly, keeping management informed on scope and findings.
• Own the automated GRC platform as the system of record — configuring tests, keeping evidence current, and closing gaps before they become findings.
• Design and build the compliance processes that don't exist yet.
• Evaluate evidence critically rather than take it at face value.
• Set the standard for security questionnaire and customer compliance responses, taking questions and evidence requests off internal stakeholder's plate and coaching teammates to do the same.
• Contribute to defining the strategic governance and compliance vision and plans aligned with general Blitzy business priorities.
• Contribute, support and eventually drive some of the wide range of GRC responsibilities, including third party and vendor risk management, customer trust and sales enablement and BC/DR governance.

Qualifications

• Required: 10+ years of experience in compliance assurance, controls and technology risk management.
• Bachelor’s in information system, computer science or a related field.
• Personal, hands‑on ownership of at least one full SOC 2 Type II or ISO 27001:2022 audit cycle — not just adjacent to one.
• Direct experience running an automated GRC/compliance platform (Vanta or equivalent) as a primary owner.
• A track record of managing multiple compliance initiatives at once as well as navigating auditor, stakeholder and vendor relationships independently, with sound judgment on when to escalate.
• The seniority and judgment to reduce stakeholder interrupt load, not add to it.
• Clear writing — policies, audit narratives, and questionnaire responses that hold up under scrutiny.
• Experience mentoring teammates or setting working standards for others.

• Nice to Have: Vendor risk management experience.
• Customer trust experience (security questionnaires and sales enablement).
• Prior work at an early stage/high growth tech company.
• FedRAMP exposure at any level.
• A track record of building a compliance process from scratch, not just running an existing playbook.
• Experience managing multiple frameworks concurrently.
• CISSP, CISA or CISM certification.

Compensation: $160,000 -$240,000 + Bonus + Equity. Blitzy is an equal opportunity employer committed to building a diverse and inclusive team. We believe different perspectives make us stronger.