Information Security Program Manager - GRC

About Upstart

At Upstart, our mission is to reduce the cost and complexity of borrowing for all Americans using creativity, advanced AI, and a human touch. As the leading AI lending marketplace, we empower banks and credit unions with smarter, fairer decisions, impacting millions.

The Team

The Information Security Governance, Risk, and Compliance (GRC) team focuses on building scalable security governance, managing risk, and ensuring regulatory compliance. The team's mission is to protect customer trust and meet regulatory commitments through automation, collaboration, and clear, secure practices.

Role Overview

As an Information Security Program Manager - GRC, you will own and execute GRC programs to protect customer trust and support regulatory requirements. You will coordinate with technical, operational, and business stakeholders to manage audits, risk assessments, policy management, and third-party security risk.

How You’ll Make An Impact

• Partner with teams to translate audit and risk requirements.
• Coordinate core assurance activities including SOX IT and SOC 2.
• Manage security due diligence for customer and partner trust.
• Own policy management and drive security awareness.
• Support third-party risk management and process improvement.

Minimum Qualifications

• 5+ years of experience in information security, GRC, or IT audit.
• Experience operating GRC programs in regulated environments.
• Knowledge of common frameworks like SOC 2, NIST CSF 2.0, etc.
• Strong communication skills for technical and non-technical audiences.
• Ability to design metrics, KRIs, and reporting.

Preferred Qualifications

• Experience in cloud-native environments (AWS preferred).
• Familiarity with GRC automation tools and scripting.
• Relevant certifications (CISSP, CISA, CRISC, CISM).
• Understanding of privacy and data protection (GDPR, CCPA).

Location & Work Arrangement

This role is available in Remote, San Mateo, Columbus, and Austin. Flexibility is provided with remote work and periodic in-person collaboration based on team needs.

Compensation & Benefits

Upstart offers competitive base salary, bonus, equity compensation, and a comprehensive benefits package including medical, dental, vision, 401(k) with matching, employee stock purchase plan, and more.

Equal Opportunity

Upstart is committed to inclusive hiring practices. For accommodation requests, email candidate_accommodations@upstart.com.

Key skills/competency

• GRC
• Information Security
• Audit
• Risk Management
• Compliance
• Policy Management
• SOC 2
• NIST
• Cloud
• Automation