About the company
At Gusto, we're on a mission to grow the small business economy. We handle payroll, health insurance, 401(k)s, and HR. With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide.
Responsibilities
- Develop, maintain, and ensure adherence to security and compliance SOPs, internal documentation, and company-wide policies—particularly supporting SOC 2.
- Own and manage trust management platforms including documentation of controls, risks, vendors, and exceptions; lead implementation of AI agents to automate controls framework and evidence collection.
- Collaborate with Legal, Enterprise Applications, and counterparts to establish and maintain data governance policies.
- Conduct ongoing internal risk assessments; coordinate remediation plans.
- Manage the third-party vendor risk program.
- Lead interactions with external auditors and regulatory bodies during compliance assessments (e.g., SOC 2 Type 2).
- Stay current on relevant compliance frameworks, laws, and regulations.
- Partner cross-functionally to implement scalable GRC processes.
Requirements
- 8+ years of experience in governance, risk, and compliance within SaaS, ideally in HCM, payroll, or fintech.
- Bachelor's degree in Business, Information Systems, or a related field.
- Strong understanding of SaaS business models.
- Proven experience leading or supporting a SOC 2 Type 2 compliance initiative.
- Familiarity with compliance tools such as Optro, Vanta, Drata, Viso Trust, or similar.
- Demonstrated ability to translate complex GRC requirements into actionable, scalable processes.
- Excellent written and verbal communication skills.
- A data-informed mindset.
- One or more relevant professional certifications: CISA, CRISC, or GRCP preferred; CGEIT, CRMA, or PMI-RMP are a bonus.
Conditions
- Cash compensation: $183,000-205,000 in the San Francisco Bay Area. Stock equity is additional.
- Hybrid: expected to work from the office approximately 2-3 days per week.