Director, GRC, Engineering (Remote Eligible)

Smartsheet has been empowering teams for over 20 years with its work management solutions. They are seeking an experienced GRC leader to oversee the Governance, Risk, and Compliance program, ensuring continuous improvement and maintaining trust with customers through effective audits and team leadership.

Responsibilities:

• Build automation into GRC
• Deploy GRC-as-Code / Policy-as-Code
• Deploy AI into our GRC processes where appropriate
• Own, manage and be accountable for supporting our revenue team by reviewing contracts both on net new deals as well as renewals
• Lead and build a high performing team
• Maintain a high level of customer service for both internal and external stakeholders and customers
• Lead our annual external audits such as SOC2, ISO 27001, ISO 27701, FedRAMP and others and serve as primary point of contact for external auditors
• Lead our internal audits and readiness assessments
• Work closely with procurement teams and manage vendor security reviews
• Manage all cybersecurity related policies, procedures, and standards
• Partner closely with Product Security & Privacy, Engineering and Product teams on security reviews and evidence collection for audits
• Define and track key performance indicators (KPIs) and key risk indicators (KRIs) from engineering and cloud telemetry data to provide measurable, risk-based insights to leadership

Requirements:

• 5+ years of people leadership experience
• 10+ years general GRC experience
• Ability to delegate and dive deep with your team to solve problems quickly
• Define and execute the multi-year vision, strategy, and roadmap for the GRC Engineering function, aligning it with overall business objectives and the security program's evolution
• Mentor and coach team members, fostering a culture of continuous learning, automation-first thinking, and professional growth in both GRC and technical engineering skills
• Manage the GRC Engineering budget, external vendor relationships, and resource allocation to ensure optimal efficiency and effectiveness of the compliance program
• Drive a proactive, security-minded, and compliance-aware culture across the entire engineering and product organization
• Strong experience in reviewing and redlining contracts
• Ability to strike a balance between customer requirements and organizational risk when considering contracting
• Strong negotiation skills when managing vendor and supply chain risks
• Proven ability to build business-centric Third Party Risk programs
• Experience with and deep knowledge of NIST 800-53
• Understanding of product development, SDLC and CI/CD
• Deep knowledge of AWS and container architecture
• Familiarity with tools like Terraform or CloudFormation for managing and auditing infrastructure configuration as code
• Experience integrating GRC processes with vulnerability management and security configuration tools to track remediation and ensure control coverage
• Strong communication (written and verbal) and diplomatic skills in building consensus from dispersed teams with competing priorities
• Build and nurture strong cross-business relationships with Engineering, IT, Product, Legal, Sales and the broader cybersecurity team