{"id":970138,"url":"https://alion.io/job/polymarket-grc-privacy-lead","title":"GRC & Privacy Lead","company":{"id":604,"name":"Polymarket","domain":"polymarket.com","url":"https://alion.io/company/polymarket","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":78,"open_postings":3,"ghost_share":0,"stale_share":0.667,"repost_share":0.333,"time_to_fill_p50_days":57,"computed_at":"2026-09-27T05:45:00Z"}},"role":"Legal","role_family":"Legal","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["New York, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":150000,"max":200000,"currency":"USD","period":"year","gross":null,"usd_annual":200000},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-09-16T16:42:40Z","employer_posted_date":"2026-09-16","last_verified_at":"2026-09-28T03:50:36Z","board_verified":true,"closed_at":null,"days_open":11,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":11},"description":"About Polymarket\nPolymarket is the world's largest prediction market platform. We enable individuals to express views on real-world events by trading on outcomes across politics, economics, sports, culture, and current affairs. Built as a peer-to-peer marketplace with no centralized \"house,\" Polymarket aggregates diverse opinions into transparent, market-based probabilities that reflect collective expectations about the future.\nWe're growing fast - both in terms of volume ($21B traded in 2025) and adoption as an alternative news source. Our ambition is to become a ubiquitous beacon of truth in global media and we need your help adding fuel to the fire.\nAbout the Role\nPolymarket's IT and Security team is small, senior, and expected to move fast. This role sits at the intersection of third-party risk, audit execution, and privacy operations - and the person in it will own all three. DSARs need to be processed, vendors need risk dispositions before they get access to our systems, and PIAs need to happen before engineering ships, not after.\nThis is a senior IC role. You'll make judgment calls independently, build processes that didn't exist before you arrived, and leave behind documentation the team can actually use. We have active audit work underway, a vendor pipeline that needs rigorous day-to-day management, and privacy obligations spanning GDPR, CCPA/CPRA, BIPA, CUBI, and the specific data flows that come with KYC and identity verification at scale.\nWhat You'll Do\nTriage vendor intake requests daily, assess inherent risk based on data sensitivity and system connectivity, and route appropriately - including flagging vendors that require PIAs or DPA review before onboarding\n\nAnalyze vendor assurance documentation - SOC 2 reports, ISO certifications, PCI AOCs, and penetration test summaries - and produce clear written risk memos with defensible dispositions\n\nGather and organize evidence for our active SOC 2 Type II engagement, coordinate with control owners to close requests on time, and manage submissions through the auditor portal from start to finish\n\nProcess DSAR requests across multiple corporate entities, applying correct retention exemptions and routing logic, and track fulfillment to meet statutory deadlines\n\nRun privacy impact assessments for new product features and vendor onboarding, working directly with product and engineering to identify risks before they ship\n\nMaintain the policy library, track review and acknowledgment cycles, and own remediation tracking for vendor and audit findings through to resolution\n\nHelp implement and operationalize our privacy compliance platform, including building out the data inventory and mapping flows that reflect how we actually collect and process personal data\n\nWhat We're Looking For\nHands-on SOC 2 Type II audit experience - you have personally gathered evidence, coordinated with control owners, and managed auditor requests through a full engagement cycle\n\nDemonstrated experience conducting third-party vendor risk assessments, including reading and interpreting SOC 2 reports, PCI AOCs, and pen test summaries, and writing risk memos with clear dispositions\n\nWorking knowledge of GDPR, CCPA/CPRA, BIPA, and CUBI, and the ability to translate those obligations into concrete process steps that product and engineering teams can follow\n\nExperience building compliance or privacy processes from scratch, not just inheriting and maintaining them\n\nComfort operating independently, triaging ambiguous situations, and making defensible decisions without waiting for escalation on routine assessments\n\n(Plus) Experience with PCI DSS scoping or self-assessment activities\n\n(Plus) Familiarity with KYC and identity verification data flows and the privacy considerations specific to biometric and identity data\n\n(Plus) Prior experience at a crypto, fintech, or prediction market company\n\nBenefits\nCompetitive salary & equity\n\nUnlimited PTO\n\nFull Health, Vision, & Dental coverage\n\n401k match\n\nHardware setup: new MacBook Pro, big display, & accessories\n\nPay Transparency\nBase salary range: $150,000 to $200,000 annually, plus equity and benefits.\nThis range reflects a good-faith estimate for this position. Experience levels vary widely within a title here, so please reach out even if your expectations fall outside it. We're always happy to chat.","description_format":"text","description_chars":4340,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["401k plan","Apple Macbook","Equity","Unlimited PTO"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Blockchain & Crypto"],"lifecycle":[{"event":"open","at":"2026-09-16T17:20:41Z"}],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":10,"expected_fill_days":57,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-09-27T05:45:00Z"},"pay":{"stated_usd_annual":200000,"is_top_pay":true},"html_url":"https://alion.io/job/polymarket-grc-privacy-lead","json_url":"https://alion.io/job/polymarket-grc-privacy-lead.json","meta":{"generated_at":"2026-09-28T04:03:32Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","usage":{"tier":"crawler","counted_by":"address","units_charged":1,"used_today":2420,"day_limit":5000,"remaining_today":2580,"minute_limit":60,"resets_at":"2026-09-29T00:00:00Z"}}}