{"id":197573,"url":"https://alion.io/job/wordsmith-grc-lead","title":"GRC Lead","company":{"id":45785,"name":"Wordsmith","domain":"wordsmith.org","url":"https://alion.io/company/wordsmith","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":87,"open_postings":15,"ghost_share":0.133,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":73,"computed_at":"2026-10-24T06:02:35Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Edinburgh, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":80000,"max_usd":141000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":25},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-07-10T21:47:10Z","employer_posted_date":"2026-07-10","last_verified_at":"2026-10-24T07:17:49Z","board_verified":true,"closed_at":null,"days_open":105,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":105},"description":"GRC Lead\nEdinburgh\nWordsmith\nWordsmith is building the AI-enabled command centre for in-house legal teams.\nOur customers are some of the most demanding enterprise legal departments in the world, and they hold us to a high bar on security, privacy, and responsible AI.\nWe're looking for a senior leader to take ownership of security and compliance as we scale.\nThe Role\nGRC Leads own security and compliance at Wordsmith end-to-end - setting the strategy for IT and infrastructure security, running our certification program across SOC 2, ISO 27001, and ISO 42001, embedding responsible-AI practices into how we build and ship product, and making sure privacy and regulatory obligations (GDPR and beyond) are handled properly as we grow.\nThis is a senior role that blends strategy and hands-on execution. You'll set multi-year direction, represent Wordsmith's security posture to executives, customers, and - as we grow - the board, and build the team, tooling, and controls the company needs at the next stage, not just maintain what exists today.\nWhat You'll Do\nSecurity Strategy & Leadership\nOwn Wordsmith's multi-year IT security and compliance roadmap - setting priorities, budget, and tooling decisions in partnership with Engineering and company leadership.\n\nIT & Infrastructure Security\nOwn security architecture across corporate IT and infrastructure - identity & access management, endpoint protection, and cloud/network security - and lead incident response when issues arise.\n\nCompliance & Certification\nOwn SOC 2 Type II, ISO 27001/27017/27018, and ISO 42001 end-to-end - policies, controls, audit evidence, and the audits themselves.\n\nAI Governance\nRun our AI governance program, including AI Impact Assessments and model/AI-vendor risk reviews, ensuring responsible, compliant AI use across the product.\n\nPrivacy Operations\nOwn privacy operations end-to-end - GDPR and other regulatory obligations, DPIAs, RoPA maintenance, sub-processor management, and Data Subject Request fulfilment.\n\nThird-Party & Vendor Risk\nAssess vendors and AI tools for security, privacy, and AI risk before they're adopted, and put the right contractual safeguards in place at a program level.\n\nTeam & Function Building\nBuild the people, process, and tooling the function needs as it scales - starting as the senior owner of the program today, with a mandate to build out a team as Wordsmith grows.\n\nExecutive & Board Reporting\nOwn risk and compliance reporting to leadership and, as we scale, the board - translating technical risk into business terms.\n\nCustomer & Deal Support\nAct as the senior voice on security for enterprise deals - security questionnaires, DPAs, and our Trust Center - partnering with Sales, Customer Success, and Legal to unblock deals without cutting corners.\n\nAutomation & Tooling\nBuild lean, automation-first tooling (e.g. Vanta) for evidence collection and ongoing compliance monitoring, so the program scales without scaling headcount unnecessarily.\n\nWhat we're looking for\nEssential\n8-10+ years in security, IT, or compliance roles, including a track record of owning a security or compliance function end-to-end at a fast-growing SaaS or tech company.\n\nProven experience building or scaling a security/compliance program from an early stage - ideally including time as the sole or founding owner of the function.\n\nDeep, hands-on expertise across SOC 2, the ISO 27000 series, and ideally ISO 42001.\n\nStrong grounding in core IT security fundamentals - identity & access management, endpoint/device security, and cloud or network infrastructure security.\n\nPractical, working knowledge of GDPR and related privacy regulation (ePrivacy or similar).\n\nExperience presenting security posture, risk, and roadmap to executives, boards, or investors.\n\nExperience building and/or managing a team - or a clear point of view on how you'd grow one as the function scales.\n\nComfortable owning budget and vendor decisions at a strategic level, not just executing against someone else's plan.\n\nA strong cross-functional operator and executive communicator, bridging Security, IT, Legal/Privacy, Engineering, and GTM.\n\nValued\nPrior experience as a Head of Security, Director of Security/IT, or similar senior/leadership title.\n\nRelevant certifications - e.g. CISSP/ISC2, CISM, AIGP, CIPP/E, CIPT, CCSK, or FIP.\n\nExperience in legal tech, AI, or another highly regulated SaaS environment.\n\nExperience designing AI risk or impact-assessment processes from scratch.\n\nFamiliarity with tools such as Datagrail, MineOS, Whistic, or SafeBase.\n\nWhy this role matters\nYou'll take a senior leadership seat over security and compliance, with real ownership over how the function is shaped and grown.\nYou'll sit at the centre of trust for a fast-growing legal AI platform, directly enabling enterprise sales and customer confidence.\nYou'll have a clear path to building and leading a team as the function scales with the company.\nWhat you can expect\nA small, focused leadership group where your work has visible, immediate impact.\nCompetitive compensation, benefits, and meaningful equity.\nHow we work\nWe're an in-office team in Edinburgh. We work together because it helps us collaborate closely across product, engineering, and legal teams. You should expect to be in the office as your default.\nThis is a high ownership role. You'll be trusted to set strategy, represent security to executives and customers, and drive outcomes without heavy oversight.","description_format":"text","description_chars":5447,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["AI Agents","Legal AI","Legal Software"],"lifecycle":[{"event":"open","at":"2026-09-03T16:37:06Z"}],"visa":[],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":1,"p_active":0.679,"p_room":0.44,"age_days":105,"expected_fill_days":73,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-10-24T06:02:35Z"},"pay":null,"html_url":"https://alion.io/job/wordsmith-grc-lead","json_url":"https://alion.io/job/wordsmith-grc-lead.json","meta":{"generated_at":"2026-10-24T10:47:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15443,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-25T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":45785},"rest":"https://alion.io/mcp/rest/get_company?id=45785"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fwordsmith-grc-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fwordsmith-grc-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fwordsmith-grc-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/wordsmith-grc-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fwordsmith-grc-lead"}]}