Lead GRC & Security Governance - Dave

Dave is hiring a Lead GRC & Security Governance to build and run the governance systems that keep Dave’s technology organization controlled, resilient, and audit-ready. This is a senior individual contributor role with meaningful ownership across technology risk, controls, assurance, incident governance, and business continuity.

The Opportunity

This is a new role with the opportunity to shape how technology governance works at Dave. You’ll build practical systems that give Security, IT, Engineering, and Data teams clear expectations for managing risk and demonstrating that controls work.

You won’t own technical remediation. You’ll define what good looks like, establish accountability, challenge gaps, and make sure material risks reach the right decision-makers.

What You’ll Build and Own

• Build and operate Dave’s technology governance program across technology and cyber risk, IT controls, change management, incident management, business continuity, and policies.
• Establish and maintain our technology control inventory, with clear owners, evidence requirements, operating cadence, exceptions, and escalation paths.
• Own technology assurance and audit readiness across programs including SOX ITGC, PCI, SOC 2, and other applicable frameworks. Coordinate evidence, support testing, identify gaps, and drive remediation accountability through closure.
• Own the technology and cyber risk register and control exception process. Surface material or sustained risks with clear context and recommendations, including when there’s resistance to escalation.
• Govern change management, incident management, and business continuity so expectations are practical, consistently followed, tested, and improved over time.
• Use AI and automation thoughtfully to improve evidence analysis, control mapping, policy maintenance, risk reporting, audit preparation, and remediation tracking while maintaining appropriate human review and data safeguards.

What We’re Looking For

• 8+ years of relevant technology experience, including significant ownership in security governance, technology risk, or security assurance.
• You’ve personally led a SOC 2 Type II, ISO 27001, or equivalent audit through a successful result—not simply supported audit preparation.
• You’ve built or materially rebuilt a governance, risk, or assurance operating model rather than only administering an established program.
• Strong technical fluency across environments such as cloud, identity, CI/CD, source control, endpoints, networks, and data platforms. You can turn ambiguous expectations into specific, testable controls and challenge answers that aren’t precise enough.
• Experience owning accountability while technical teams own remediation. You can influence Engineering, SRE, Security, IT, and Data partners without taking their work over.
• Sound judgment around risk and materiality, including demonstrated experience escalating meaningful risks when stakeholders disagreed.
• Experience partnering credibly with Internal Audit and Legal in addition to technical and Security teams.
• Strong written communication and program management skills.

Bonus Points

• Experience with SOX ITGC, PCI DSS, NIST-based programs.
• Experience with AI governance or third-party AI risk.
• Experience with GRC automation platforms such as Vanta or Drata.

Organizational Context

• Reports to: Sr. Director, Security & IT
• Team Structure: Highly collaborative partnership across Security, IT, Engineering, Data, Internal Audit, Legal, and Compliance.

Benefits & Perks

• 💻 Virtual-first work culture with a home office stipend
• 🏥 Premium Medical, Dental, and Vision Insurance plans
• 👶 Generous paid parental and caregiver leave
• 💰 401(k) savings plan with matching contributions
• 📈 Financial advisor and financial wellness support
• 🏖️ Flexible PTO and generous company holidays (including Juneteenth and Winter Break)
• 🎉 Annual in-person retreats and virtual team events