GRC Director

Profound is the fastest-growing AI marketing platform, used by 15% of the Fortune 500 including Comcast, Estée Lauder, and Walmart, and innovators like Ramp, MongoDB, and Figma. It is where marketing teams do the work: research, briefs, content, campaigns, reporting, all in one place, alongside agents that carry the load with them.

Built on 2B+ real user prompts and growing, Profound’s data shows you what people ask AI and what the models say back. Profound's AI Marketer joins that data with deep context about our customers to find the opportunities worth acting on, and then puts agents to work: automating reporting, drafting content, auditing pages for readability, running competitive research. It measures what works and gets better every day.

We are hiring a GRC Director to own and scale our security and compliance programs while working closely with engineering, sales, and customer success.

Profound sells to enterprises with serious security expectations, and our GRC function is central to closing deals, sustaining customer trust, and meeting the regulatory bar for the markets we operate in. This is not a "watch the dashboard and file the report" role. You'll shape how we build secure systems, push remediation through with engineering, and make sure compliance accelerates the business rather than slowing it down.

What you'll do

• Own and operate our compliance frameworks: SOC 2, ISO 27001, GDPR, and others as we grow

• Drive audits end to end: readiness, evidence collection, auditor coordination

• Continuously improve controls and reduce compliance overhead through automation

• Partner with Sales and Customer Success to unblock deals and build trust with security teams at Fortune 500 customers

• Develop and maintain our trust center, security whitepapers, and customer-facing documentation

• Work directly with engineering to design and implement practical security controls across our cloud infrastructure, data pipelines, and customer-facing surfaces

• Partner on identity and access work (SSO, SAML, SCIM, IdP integrations) where security, compliance, and customer-facing requirements intersect

• Translate compliance requirements into technical, scalable solutions

• Identify gaps and drive remediation, not just report them

• Run risk assessments across systems, vendors, and processes

• Maintain policies and standards that are lightweight, current, and actually useful

• Track and report on our security posture and compliance status to leadership