Everlaw is seeking a pragmatic and execution-oriented Director of GRCT to lead our Governance, Risk, Compliance, and Trust function. This role is responsible for setting the "North Star" for how we manage risk, earn customer trust, and scale compliance programs in a way that enables—rather than slows—business innovation.

Reporting to the VP of Information Technology & Security, you will own the day-to-day execution and continuous evolution of Everlaw’s risk, compliance, and trust programs, ensuring our governance posture scales with the business. This role sits at the intersection of technical rigor and commercial enablement, partnering closely with DevOps, Product Security, Corporate Security, Legal, Engineering, Sales, and Customer teams to translate complex requirements into clear controls and credible assurances that build customer confidence.

Getting started

We want you to feel like part of the team early on! Our onboarding process will integrate you into the company with informative sessions on our product, policies, processes, and team structure and goals.
We’re excited for you to learn, grow, and contribute right away! We trust that you’ll bring experience and knowledge that will uplift and uplevel the team, but we don’t expect you to know everything on Day 1.

In your role, you'll...

Compliance & Audits

Public Sector Compliance Ownership: Own Everlaw’s public sector compliance posture, including FedRAMP and GovRAMP authorization and ongoing maintenance.
Regulatory & Contractual Requirements: Ensure compliance with specialized regulatory and contractual requirements (e.g., CJIS, FTI), partnering with HR, Security, and Legal to support personnel, access, and operational controls.
Global & Industry Certifications: Accountable for global and industry certifications, including SOC 2, ISO 27001/27017/27018, UK CE+, GDPR, and HIPAA, enabling effective IC-led execution.
Audit Readiness & Execution: Ensure sustained audit readiness through clear control ownership, effective evidence management, and scalable compliance processes.
Strategic Certifications & Market Access: Own the go/no-go framework for pursuing new certifications or regulatory authorizations (e.g., ISO 42001), balancing customer demand, regulatory risk, and business priorities.
Regulatory Awareness: Continuously monitor emerging regulatory and industry requirements and advise leadership on impact, readiness, and timing.

Risk Governance & Decision Enablement

Security Risk Identification & Management: Oversee the identification, assessment, and tracking of information security risks; partner with risk owners to remediate risks in a timely manner.
Security Impact Analysis (SIA): Partner with Security Engineering to lead the SIA process for major system, infrastructure, and product changes, where SecEng conducts technical SIA and GRCT evaluates risk, notification, and escalation requirements.
Third-Party Security Risk: Oversee the vendor security risk lifecycle, from onboarding through ongoing monitoring and renewal, ensuring risks are assessed and managed in proportion to data sensitivity and business criticality while supporting efficient procurement.
Pragmatic Governance & Decision Support: Maintain security policies, standards, and exception processes aligned with how Engineering, Security and IT teams operate, and act as a trusted advisor to facilitate risk-based decisions on architectural trade-offs and control exceptions.
Emerging Technology & Risk Visibility: Govern security risks related to emerging technologies, including AI/ML, and provide clear, audit-ready risk reporting to leadership that integrates with compliance and evidence pipelines.

Customer Trust & External Assurance

Customer Trust Ownership: Own Everlaw’s customer-facing trust posture, ensuring external representations of security, privacy, and compliance accurately reflect internal controls and risk decisions.
Trust Center & Artifacts: Set direction and provide oversight for Everlaw’s Trust Center and related trust artifacts, ensuring content is accurate, current, and aligned with internal governance, while enabling first-line execution by the Customer Trust function.
Customer Assurance Model: Partner with Sales, Customer Success, and Legal to support customer security questions, reviews, and audits, acting as the escalation point for complex, high-risk, or non-standard requests to maintain sales velocity and deal integrity
Strategic Engagement: Act as a subject matter expert in executive-level customer conversations on trust and security compliance topics as needed, particularly for enterprise and public sector customers.
Feedback Loop: Ensure customer trust insights and recurring assurance themes inform risk governance and compliance priorities.

Operational Excellence & Program Enablement

Program Operations & Scalability: Drive operational excellence across GRCT programs by improving core processes, reducing manual effort, and ensuring programs scale efficiently as Everlaw grows by integrating GRC workflows directly into Engineering and Product lifecycles.. Identify and eliminate friction in high-velocity workflows such as the security questionnaire response, SIA, and vendor reviews.
Systems, Automation & Tooling: Own the evolution of the GRCT tech stack (e.g., real-time compliance platforms), increasing automation and data quality to move the organization toward automated Continuous Control Monitoring (CCM) and “audit once, satisfy many” outcomes.
Metrics & Execution Rigor: Establish clear program metrics and operating rhythms to track effectiveness, surface bottlenecks, and drive predictable execution across compliance, risk, and trust activities.
People & Team Leadership: Lead, coach, and develop GRCT team members, providing clear expectations, performance feedback, and growth opportunities while fostering a high-ownership, execution-focused culture.
Continuous Improvement & Resourcing: Champion continuous improvement by incorporating lessons learned from audits and customer feedback into program enhancements. Manage the GRCT roadmap and resource planning to ensure the function is equipped to support Everlaw’s expanding certification requirements.

About you

You are a pragmatic, execution-oriented GRCT leader with deep experience operating regulated SaaS environments. You bring 10+ years of experience in Information Security, Risk, or Compliance, including senior ownership of FedRAMP Moderate/High programs from authorization through steady-state operations.
You have a builder mindset, with hands-on experience implementing modern GRC automation platforms and driving a shift from manual compliance processes toward Continuous Control Monitoring.
You exercise strong risk judgment, evaluating control gaps, exception requests, and architectural trade-offs pragmatically—translating security and compliance requirements into practical, scalable engineering controls.
You are a trusted partner to Engineering, with the technical literacy to lead Security Impact Analyses (SIA) and embed compliance into DevOps and CI/CD workflows rather than bolting it on after the fact.
You bring a commercial lens to trust, with experience supporting customer assurance and GTM efforts—from complex security questionnaires to executive-level conversations with enterprise and public sector customers.
You are an operational and people leader, skilled at establishing operating rhythms, defining meaningful program metrics, driving predictable execution, and coaching high-ownership teams.
You are a clear and credible communicator, able to distill complex technical and regulatory topics into concise, actionable guidance for technical teams and senior leadership.
You have a Bachelor’s degree in Information Security, Computer Science, Engineering, Information Systems, or a related field (or equivalent practical experience) and possess relevant security certifications such as CISM, CISSP, or CISA.

Benefits

The expected salary range for this role is between $230,000 and $312,000. The final offered salary will be dependent upon many factors including the candidate’s experience and skills. The base pay range is subject to change in the future.
Equity program
401(k) retirement plan with company matching
Health, dental, and vision
Flexible Spending Accounts for health and dependent care expenses
Paid parental leave and approximately 10 days (80 hours) per year of sick leave
Seventeen paid vacation days plus 11 federal holidays
Membership to Modern Health to help employees prioritize mental health and wellness
Annual allocation for Learning & Development opportunities and applicable professional membership dues
Company-sponsored life and disability insurance
Find out more about our Benefits and Perks

Perks

Work in Uptown Oakland, just steps from the BART line and dozens of restaurants and walking distance to Lake Merritt
Flexible work-from-home days on Tuesdays and Fridays
Monthly home internet reimbursement
Select your preference of hardware (Mac or PC) and customize your desk setup
Enjoy a wide variety of snacks and beverages in the office
Bond over company-wide out-of-the-box events and fun activities with your team
Time off for company-sponsored volunteer events and 4 paid hours per quarter to volunteer at a charitable organization of your choice
Take advantage of learning and career development opportunities
Ranked #9 on Glassdoor's Best Places to Work 2023 for US small and medium companies
One of Wealthfront’s 2021 Career Launching Companies, and ranked #2 on the “2022 Bay Area Best Places to Work” list by the San Francisco Business Times and the Silicon Valley Business Journal
One of Fast Company’s World's Most Innovative Companies for 2022 and proud contributor of free ediscovery resources to benefit the greater good through “Everlaw for Good”
#LI-JA1
#LI-Hybrid

Pursue Truth While Finding Yours

At Everlaw, we are deeply invested in pursuing the truth, for our clients and for our employees. We know that when you’re empowered to pursue your passions, it is reflected in the work. That’s why we’re committed to the professional growth of all our team members, offering an annual learning and development stipend and regular career check-ins with managers. If you’re looking for a place that values passion, integrity, and a desire to learn, we’d love to hear from you!

About Everlaw

We help law firms, government agencies, and corporations sift through millions of documents of evidence in big lawsuits and investigations to find the proverbial smoking gun (or needle in the haystack -- pick your metaphor). It's a multi-billion dollar space typically dominated by service-oriented vendors, and we're coming at it with cutting-edge technology and elegant design. It's working, and we've been growing very rapidly: we host hundreds of terabytes of data and work with all 50 state Attorneys General and hundreds of law firms on some of the most high-profile cases litigated today.

Everlaw is an equal opportunity employer. We pride ourselves on having a diverse workforce and we do not discriminate against any employee or applicant because of race, creed, color, religion, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We respect the gender, gender identity and gender expression of our applicants and employees, and we honor requests for pronouns. It is our policy to comply with all applicable national, state and local laws pertaining to nondiscrimination and equal opportunity, including the California Equal Pay Act. Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.

We collect and process the personal information you provided along with your job application in accordance with our Applicants Privacy Notice and Notice at Collection.

When preparing to engage with Everlaw as a candidate, you may use AI tools for research, polishing application materials, and interview prep. However, any assessments (unless explicitly stated), remote interviews or live interviews must be completed independently without AI support. By submitting your application, you agree to adhere to these rules. Here's the link to our full policy, and please reach out with any questions!

We use Covey as part of our hiring and/or promotional processes. As part of the evaluation process, we provide Covey with job requirements and candidate-submitted applications. Certain features of the platform may qualify it as an Automated Employment Decision Tool (AEDT) under applicable regulations. For positions in New York City, our use of Covey complies with NYC Local Law 144. We began using Covey Scout for Inbound on the 9th of June, 2025.

Find Your Perfect Job

Find Your Perfect Job