133K–183K USD / year
GRC Program Manager
OperationsHybrid — San Francisco, California, United States
Published on 2026-11-05
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Manage Superhuman’s integrated external audit program across security and AI compliance frameworks. Coordinate quarterly audits, assess new framework and scope expansions, and improve audit processes through evidence reuse and automation.
About the company
Superhuman is an email productivity tool designed to enhance users' efficiency and workflow. The company serves professionals looking to optimize their email management through innovative features and streamlined processes.
The team
G&A and Legal
What you'll do
- Manage an integrated audit plan, calendar, milestones, dependencies, risks, and stakeholder updates.
- Plan and run quarterly audits from scoping and readiness through reporting and findings closeout.
- Coordinate audit scope with Product and Engineering and assess changes caused by launches or new platforms.
- Build and maintain the audit operating model and runbook.
- Drive automation for evidence collection, request tracking, and audit reporting.
- Coordinate third-party risk management with GRC and Procurement.
- Assess new frameworks and scope expansions, presenting gap assessments and effort estimates to leadership.
- Manage auditor relationships and coordinate remediation of findings.
What we're looking for
- 5+ years of program management experience running multi-workstream programs.
- 5+ years managing external security audits, including SOC 2 and ISO 27001.
- Working knowledge of SOC 2, the ISO 27000 family, ISO 42001, and PCI-DSS.
- Experience leading and presenting a framework or scope gap assessment.
- Experience building or improving audit processes, including calendars, request tracking, and runbooks.
- Technical fluency to assess cloud evidence and system-generated reports and identify automation opportunities.
- Strong stakeholder communication, prioritization, and influence without direct authority.
Nice to have
- Experience with additional frameworks such as ISO 27701, ISO 27018, CSA STAR, IRAP, ISMAP, or C5.
- Experience automating evidence collection or audit reporting, or using LLMs for program work.
- Familiarity with GRC platforms or lightweight internal tooling.
Benefits
- 20 days of paid time off, 12 paid holidays, two floating holidays, and flexible sick time.
- Paid parental leave.
- 401(k) or RRSP matching.
- Health, dental, vision, mental health, and fertility benefits.
- Professional development budget and stipends for caregiving, wellness, and home office.