GRC Program Manager

Clay is an AI-powered platform that helps companies identify and execute their next best business moves. The company aggregates data for B2B organizations and provides infrastructure to run personalized campaigns across email, ads, landing pages, and workflows. Clay recently raised $115M in Series D funding and is scaling rapidly with thousands of customers including Anthropic, OpenAI, Google, and Visa.

Clay has built a distinctive culture that values creativity and personal expression alongside professional excellence. The company employs diverse team members from various backgrounds and offers access to world-class coaching in areas like creativity and management. Clay's operating principles emphasize practical wisdom and flexibility in how the organization approaches its work.

As Clay scales, governance, risk management, and compliance have become central to building customer trust and maintaining operational integrity. This role sits at the intersection of security, legal, and business operations, requiring someone who can establish compliance infrastructure across the organization.

What you'll do

• Build and manage the complete vendor onboarding process, including security reviews, data privacy assessments, DPA agreements, SOC 2 and GDPR evaluations, subprocessor list maintenance, and customer notifications

• Serve as the primary contact and operator for external GRC vendors, managing intake requests, ticketing systems, service level agreements, quality assurance, and performance tracking

• Design and execute compliance review processes when teams evaluate new data purchases and vendor partnerships

• Create scalable operational systems and processes from the ground up to support compliance work across engineering, security, legal, and business teams, owning initiatives end-to-end

• Respond to customer security and privacy questionnaires from both prospective and existing clients, with emphasis on data protection and regulatory compliance questions

What you'll bring

• Bachelor's degree in Information Security, Business, or related field, or equivalent professional experience

• Five or more years building and scaling operational programs in SaaS or technology environments

• Demonstrated ability to create processes and systems from scratch rather than simply maintaining existing ones

• Practical knowledge of privacy regulations including GDPR and CCPA/CPRA, with ability to apply them across vendor management and data handling

• Experience conducting vendor risk assessments, evaluating security questionnaires, and managing Data Processing Agreements and subprocessor documentation

• Familiarity with compliance tools such as Vanta, Transcend, or comparable platforms, plus understanding of DSAR processes

• Strong project management skills for complex cross-functional work

• Excellent communication ability across legal, engineering, data, and business teams

• Capacity to work independently, manage priorities effectively, and thrive in a fast-moving growth environment

Nice to have

• Knowledge of ISO 27001, SOC 2, or other compliance frameworks

• Experience with data mapping, privacy impact assessments, or privacy-related incident response

• Technical understanding of SaaS infrastructure and data architecture

What they offer

• Full-time position based in New York with hybrid work arrangement

• Access to professional coaches specializing in creativity and management development