GRC Principal - Data Privacy and Security

About Us: Wrapbook is the AI platform for production finance. We’re building a system of action that puts finance teams in control of their whole production, from payroll, to spend, to accounting. Built for feature films, TV, and commercials, Wrapbook is trusted by teams at Netflix, Paramount, Anonymous Content, and more. With backing from Andreessen Horowitz, Bessemer Venture Partners, and Jeffrey Katzenberg's WndrCo, our team of 350+ is using AI to transform how finance teams work and empower them to do more with less. The Opportunity – GRC Principal - Data Privacy and Security (Remote - USA / CANADA): We're hiring a Principal GRC Manager (Individual Contributor) to serve as a subject matter expert and technical authority leading Wrapbook's privacy and security GRC programs. This is a high-ambiguity, high-autonomy role for someone who has built and matured GRC programs at a fintech or SaaS company from the ground up. This person will not just maintain grc activities, but bring a strong point of view to set the multi-year direction for how Wrapbook manages GRC investment on the security and privacy front as our AI capabilities expand. This person is both excited to drive the strategic direction and own the ground-level execution across their areas, leveraging AI to amplify their output. You understand the difference between checking boxes and high judgment decisions, you focus on outcomes over activity. You cleanly separate the must-dos and the nice-to-haves informed by a business’ risk appetite, industry context, and overall company objectives. You have a proven track record of building AI-first solutions for traditional GRC problems; you have the expertise and experience to validate AI outputs. You thrive on systems-thinking and delivering measurable results with rigor; you’ll own the project management, frameworks, measurement, outward and upward reporting, influence executives and leaders. You’ll evolve a program that passes SOC 1 and SOC 2 Type II audits, moving it from "successful audits" to durable, continuously audit-ready operational maturity. You are a bridge-builder, you know how to develop, grow, and leverage strong relationships and trust with cross-functional stakeholders and leadership. What You'll Do: Data Security GRC • Lead the annual SOC 1 and 2 audit lifecycle end-to-end: control monitoring/readiness, work with our SOC auditors and internal business teams to complete the audit project and reporting supporting evidence collection and clarification process, drive control-owner accountability and lead program development to embed continuous, evidence-driven controls. • Own and evolve Wrapbook's ISMS policy suite and control framework (SOC 1, SOC 2 Type II; explore additional ISO compliance opportunities) in collaboration with our Business, Legal, and Security teams. • Mature our approach to vendor risk management, developing and evolving the program, frameworks, prioritization, stakeholder management, and measurement. • Lead Customer Assurance efforts for enterprise security reviews (e.g., enterprise customer and prospect review requirements, cyber-insurance self-assessments) and scale Wrapbook's security and privacy documentation and mechanisms. Data Privacy GRC • Collaborate with Legal and Security teams to build and evolve Wrapbook’s Data Governance program across the data lifecycle (data collection, storage, access, retention, deletion). • Beyond project management you will make recommendations and own decisions on how to best solve Wrapbook’s dynamic and growing data governance challenges. • Build and evolve the privacy compliance program across GDPR and CCPA — DSAR operations, data mapping, retention, and the data governance and classification program. • Partner with Legal on DPAs, subproces