GRC Manager

About this role

Own and operate OpenRouter’s compliance program, maintaining audit readiness across established frameworks and emerging AI regulations. This is a hands-on role that works closely with engineering and cross-functional partners to turn requirements into practical controls.

About the company

OpenRouter is a unified API that routes requests across large language model providers so developers can access, switch, and scale models without lock-in or complex multi-provider integrations.

The team

IT & Security; reports to the Head of IT & Security.

Stack

What you'll do

• Administer Drata, monitor control health, and coordinate evidence collection.
• Maintain SafeBase’s security knowledge base and handle escalated customer questionnaires.
• Drive policy acknowledgments, device compliance, and recurring security and compliance training.
• Lead access reviews, penetration tests, BCDR and incident response exercises, policy reviews, and risk assessments.
• Partner with engineering on product compliance, data handling, and customer commitments.
• Maintain audit readiness for SOC 2, HIPAA, PCI DSS, GDPR, CCPA, BIPA, and the EU AI Act.
• Translate emerging AI regulations into practical controls.

What we're looking for

• Several years of hands-on GRC or compliance program experience.
• Owned at least one SOC 2 audit cycle from evidence collection through fieldwork.
• Admin-level experience with a compliance automation platform; Drata preferred.
• Able to discuss architecture and data flows with engineers.
• Demonstrated cross-functional influence and comfort with changing, ambiguous requirements.

Nice to have

• PCI DSS experience in a startup.
• HIPAA experience as a Business Associate.
• EU AI Act or other emerging AI regulation experience.
• CISA, CISSP, or CIPP certification.
• Experience as a first compliance hire.
• Scripting for evidence collection.

Benefits

• Equity