GRC Automation & Assurance Lead

We are Rokt, a hyper-growth ecommerce leader. Rokt is the global leader in ecommerce, unlocking real-time relevance in the moment that matters most. Rokt’s AI Brain and ecommerce Network powers billions of transactions connecting hundreds of millions of customers, and is trusted to do this by the world’s leading companies.

We are a team of builders helping smart businesses find innovative ways to meet customer needs and generate incremental revenue. Leading companies drive 10-50% of additional revenue—and often all their profits—from the extra products or services they sell. This economic edge unleashes a world of possibilities for growth and innovation.

At Rokt, we practice transparency in career paths and compensation. We believe in transparency, which is why we have a well-defined career ladder with transparent compensation and clear career paths based on competency and ability. Rokt’stars constantly strive to raise the bar, pushing the envelope of what is possible.

We are looking for a GRC Automation & Assurance Lead

Target total compensation ranges from $214,000 - $255,000, including a fixed annual salary of $174,000- $215,000, an employee equity plan grant, and world-class benefits.

Equity grants are issued in good faith and are subject to company policies, board approval, and individual eligibility.

About the Role:

We are looking for a GRC professional who is equal parts auditor and builder. Rokt's information security management system is ISO 27001 and SOC 2 certified, and protects personal customer data entrusted to us by leading global e-commerce brands with a combined 100 million transactions each month. As we scale, we are reimagining GRC as an AI-first function — one where agents and automation do the heavy lifting on evidence collection, control monitoring, questionnaire response, and audit preparation, freeing humans to focus on judgment, strategy, and stakeholder partnership.

You will own the audit, assurance, and compliance pillar of our GRC program, and you will lead the design and engineering of the agentic systems that run it. This is not a "use ChatGPT to summarise a policy" role. You will architect and ship agents on our internal Security Agent Suite, build internal GRC tools using AI coding agents like Claude Code and Cursor, and treat automation as a first-class deliverable alongside the audits you lead.

You will work closely with engineering, product, legal, finance, people, and our external auditors to drive ISO 27001, SOC 1, and SOC 2 programs to clean outcomes — and to make sure that next year, the same outcomes are achieved with materially less manual effort. You move fast, you prefer significant leaps over small iterations, and you genuinely enjoy the intersection of compliance rigour and AI engineering.

Responsibilities:

AI automation and tooling

• Architect, build, and maintain agents on Rokt's internal Security Agent Suite for GRC workflows, including client security questionnaires, evidence collection, control testing, vendor assessments, DPIAs, and audit preparation
• Design new GRC automations end-to-end: scope the workflow, build the agent or tool, validate outputs, and roll it out with the rest of the GRC team
• Build internal tools and integrations using AI coding agents (Claude Code, Cursor, or equivalents) to extend our in-house GRC systems and Jira-based workflows
• Continuously evaluate agent performance, refine prompts and tool definitions, and improve coverage and accuracy of automated controls

Audit, assurance, and compliance

• Lead the ISO 27001:2022 surveillance and recertification cycles, and SOC 1 and SOC 2 Type 2 audits, end-to-end
• Plan and execute Rokt's internal audit program (user access, exemptions, DPIAs, SCF controls, AI controls), ideally with agent-assisted execution
• Drive external auditor engagement, evidence collection, and remediation tracking
• Manage the processing of client security questionnaires using and continuously improving the questionnaire agent
• Maintain and evolve ISMS performance metrics, including new metrics covering AI control effectiveness and automation coverage
• Coordinate Rokt's security calendar including audit windows
• Produce and maintain quality procedure documentation co-authored with AI assistance

Requirements

Compliance and audit experience

• 4+ years of relevant experience in Governance, Risk & Compliance, ideally in a fast-moving tech environment
• Working knowledge of ISO 27000 family, SOC 1, SOC 2, NIST CSF, and privacy regulations (GDPR, CCPA, CPRA); bonus for PCI-DSS, CIS, SCF, ISO 42001, NIST AI RMF
• Hands-on internal auditing experience against ISO 27001 and SOC 2
• Track record managing external audits end-to-end, including evidence collection, auditor engagement, and findings remediation
• Solid grasp of controller/processor concepts and broader privacy fundamentals

AI and technical skills (this is the differentiator)

• Demonstrated experience designing and shipping agentic AI systems — not just using a chatbot. You have built agents that take actions, call tools, integrate with APIs, and complete multi-step workflows
• Comfortable using AI coding agents (Claude Code, Cursor, Copilot, or similar) to build and maintain internal tools; able to read, modify, and ship code even if you don't consider yourself a software engineer
• Familiarity with at least one agent framework (Google ADK, LangGraph, OpenAI Agents SDK, MCP, or similar) and the core patterns: tool use, memory, evaluation, guardrails
• Understanding of LLM risks and controls — prompt injection, model misuse, agent autonomy, data leakage — and how they map to frameworks like OWASP Agentic Top 10 or NIST AI RMF
• Working knowledge of basic IT, cloud (AWS preferred), APIs, and SQL
• Comfort with version control (Git/GitHub) and basic scripting (Python or TypeScript)

Ways of working

• Strong written and verbal communication; able to translate technical detail into business language for leadership, clients, and auditors
• Demonstrated ability to break complex compliance requirements into scalable, automated processes that don't slow the business down
• Bias for shipping, comfort with ambiguity, and a builder mindset
• Strong attention to detail balanced with willingness to use AI to extend it
• Highly responsive, autonomous, and resilient

Benefits

About Rokt’stars:

As a mission-driven, hyper-growth community of curious explorers, our ambition is to unlock real-time relevancy in ecommerce and beyond. Our bias for action means we are not afraid to quickly venture into uncharted territories, take risks, or challenge the status quo; in doing so we either win or learn. We work together as one aligned team, never letting egos get in the way of brilliant ideas. We value diversity, transparency, and smart humble people who enjoy building a disruptive business together. We pride ourselves on being a force for good as we make the world better.

About the Benefits :

We leverage best-in-class technology and market-leading innovation in AI and ML, with all of that being underlined by building and maintaining a fantastic and inclusive culture where people can be their authentic selves, and offering a great list of perks and benefits to go with it:

• Become a shareholder. Every Rokt’star gets equity in the company
• Enjoy catered lunch every day and healthy snacks in the office. Plus join the gym on us!
• Access generous retirement plans like a 4% dollar-for-dollar 401K matching plan and get fully funded premium health insurance!
• Dog-friendly office
• Extra leave (bonus annual leave, sabbatical leave etc.)
• Work with the greatest talent in town
• See the world! We have offices in New York, Seattle, Sydney, Tokyo and London

We believe we’re better together. We love spending time together and are in the office most days (teams are in the office minimum 4 days per week).

We at Rokt choose to create a company that is as diverse and inclusive as the world we live in by attracting, growing & keeping the best talent. Equal employment opportunities are available to all applicants without regard to race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.