Mid Level GRC Manager Jobs
Mid level grc manager jobs go to professionals ready to own compliance programs end to end, guide junior analysts through assessments, and make risk decisions without waiting for direction. Openings are 9% remote or hybrid across Technology & Software, Retail, and Manufacturing, with employers like TikTok USDS Joint Venture, Plaid, and Vercel hiring at this level now.
Find Mid Level GRC Manager JobsOverview
Showing 5 of 14+ Mid Level GRC Manager jobs
INTRODUCTION
Wilson Sonsini is the premier legal advisor to technology, life sciences, and other growth enterprises worldwide. We represent companies at every stage of development, from entrepreneurial start-ups to multibillion-dollar global corporations, as well as the venture firms, private equity firms, and investment banks that finance and advise them. The firm has approximately 1,100 attorneys in 17 offices: 13 in the U.S., two in China, and two in Europe. Our broad spectrum of practices and entrepreneurial spirit allow exceptional opportunities for professional achievement and career growth.
ROLE AND RESPONSIBILITIES
The GRC Engineer is a mid-level position that works under the direction of the governance, risk and compliance leadership and reports to the Manager of IT Risk Operations. The position is technical and analytical in nature and requires a self-directed professional who is committed to applying industry best practices in the areas of governance, risk, and compliance.
Essential Duties and Responsibilities:
Framework Alignment and Control Mapping
- Contribute to the implementation and maintenance of the client’s NIST Cybersecurity Framework (CSF) program, including tracking progress against current and target profiles and supporting assessments against related standards (e.g., ISO/IEC 27001, CIS Controls, SOC 2).
- Map the security controls in the current environment to NIST requirements (e.g., SP 800-53) and other applicable frameworks, perform gap analyses and self-assessments, and identify gaps for remediation.
- Support delivery of the client’s current security risk and compliance standards and maintain related documentation.
Risk Management and GRC Tooling
- Record and maintain security risks in the Risk Register, and coordinate with other teams as needed to obtain status and provide insights for remediation of risks.
- Contribute to the ServiceNow implementation (e.g., requirements, testing, and workflow input).
- Identify critical/high-risk systems and processes and document the associated risk profiles.
- Resolve tickets assigned to the governance, risk and compliance team and track them to closure.
- Prepare and deliver periodic risk, compliance, and service-level metrics and reports for the client’s program, tailored to leadership and stakeholder audiences.
Threat and Risk Analysis
- Gather and analyze data from various IT systems and security tooling (e.g., SIEM and log sources, unauthorized access attempts, phishing reports) that identify risk, and create reports that provide specific details.
- Use threat, vulnerability, and endpoint/cloud security management systems and tools (e.g., SIEM, vulnerability scanners, Microsoft Defender) to identify critical/high-risk systems, create threat analysis reports, initiate follow-up action, and help reduce risk.
- Partner with security operations and incident response teams to translate incident and vulnerability trends into risk register entries and remediation recommendations, and maintain related standard operating procedures.
- Analyze policies, systems, hardware, software, cloud, and network infrastructure and recommend methods and strategies that reduce risk.
Awareness, Third-Party Risk and Client Assurance
- Administer the cybersecurity awareness training program (e.g., assigning courses, tracking completion, and reporting results).
- Conduct Third-Party Risk Management analysis, including review of vendor security documentation and recording of results.
- Complete security questionnaires and provide supporting documentation within agreed turnaround times.
- Perform other related duties as assigned by the client’s governance, risk and compliance leadership.
BASIC QUALIFICATIONS
- 3+ years of experience in security risk, governance, and compliance (GRC). Security operations or incident response experience with demonstrated GRC exposure (e.g., control assessments, audits, compliance reporting) will be considered.
- Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, and SP 800-39, with an understanding of the cybersecurity risk assessment process.
- Working knowledge of IT fundamentals, including networking, identity and access management (e.g., Active Directory), and cloud security (e.g., Microsoft Azure).
- Excellent written and verbal communication skills, with the ability to explain risk to technical and non-technical audiences.
- Strong organizational, interpersonal, and critical thinking skills, with the ability to manage multiple priorities under pressure, work independently, and collaborate with diverse teams.
- Sound judgment, high ethical standards, and the discretion to handle confidential client information.
- Ability to respond promptly to unplanned requests within agreed service-level expectations and to accurately estimate time and resources for projects.
- Commitment to continuous learning of new technologies, frameworks, and skills.
- Associate’s or Bachelor’s degree in information security, information technology, risk management, or a related field, or equivalent combination of education, certification, and experience.
- Relevant certifications preferred (e.g., CompTIA Security+, CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, Microsoft SC-200 or AZ-500).
PREFERRED QUALIFICATIONS
- Law firm experience, including responding to client security questionnaires and reviewing outside counsel guidelines.
- Experience with a GRC platform (e.g., ServiceNow, RSA Archer) and with SIEM, vulnerability, or threat management tools (e.g., Microsoft Sentinel, Splunk).
- Scripting or automation experience (e.g., Python, PowerShell, KQL) to streamline recurring GRC reporting and data-gathering.
- Working knowledge of Claude, Legora, BitSight, and/or Prompt Armor.
LOCATION
Location: Palo Alto
650 Page Mill Road
Palo Alto
CA 94304-1050
US
The primary location for this job posting is in Palo Alto. The actual base pay offered will depend upon a variety of factors, including but not limited to the selected candidate’s qualifications, years of relevant experience, level of education, professional certifications and licenses, and work location. The anticipated pay range for this position is as follows: $116,875 – $158,125 per year.
The compensation for this position may include a discretionary year-end merit bonus based on performance. We offer a highly competitive salary and benefits package.
Benefits information can be found here.
Equal Opportunity Employer (EOE).
INTRODUCTION
Wilson Sonsini is the premier legal advisor to technology, life sciences, and other growth enterprises worldwide. We represent companies at every stage of development, from entrepreneurial start-ups to multibillion-dollar global corporations, as well as the venture firms, private equity firms, and investment banks that finance and advise them. The firm has approximately 1,100 attorneys in 17 offices: 13 in the U.S., two in China, and two in Europe. Our broad spectrum of practices and entrepreneurial spirit allow exceptional opportunities for professional achievement and career growth.
ROLE AND RESPONSIBILITIES
The GRC Engineer is a mid-level position that works under the direction of the governance, risk and compliance leadership and reports to the Manager of IT Risk Operations. The position is technical and analytical in nature and requires a self-directed professional who is committed to applying industry best practices in the areas of governance, risk, and compliance.
Essential Duties and Responsibilities:
Framework Alignment and Control Mapping
- Contribute to the implementation and maintenance of the client’s NIST Cybersecurity Framework (CSF) program, including tracking progress against current and target profiles and supporting assessments against related standards (e.g., ISO/IEC 27001, CIS Controls, SOC 2).
- Map the security controls in the current environment to NIST requirements (e.g., SP 800-53) and other applicable frameworks, perform gap analyses and self-assessments, and identify gaps for remediation.
- Support delivery of the client’s current security risk and compliance standards and maintain related documentation.
Risk Management and GRC Tooling
- Record and maintain security risks in the Risk Register, and coordinate with other teams as needed to obtain status and provide insights for remediation of risks.
- Contribute to the ServiceNow implementation (e.g., requirements, testing, and workflow input).
- Identify critical/high-risk systems and processes and document the associated risk profiles.
- Resolve tickets assigned to the governance, risk and compliance team and track them to closure.
- Prepare and deliver periodic risk, compliance, and service-level metrics and reports for the client’s program, tailored to leadership and stakeholder audiences.
Threat and Risk Analysis
- Gather and analyze data from various IT systems and security tooling (e.g., SIEM and log sources, unauthorized access attempts, phishing reports) that identify risk, and create reports that provide specific details.
- Use threat, vulnerability, and endpoint/cloud security management systems and tools (e.g., SIEM, vulnerability scanners, Microsoft Defender) to identify critical/high-risk systems, create threat analysis reports, initiate follow-up action, and help reduce risk.
- Partner with security operations and incident response teams to translate incident and vulnerability trends into risk register entries and remediation recommendations, and maintain related standard operating procedures.
- Analyze policies, systems, hardware, software, cloud, and network infrastructure and recommend methods and strategies that reduce risk.
Awareness, Third-Party Risk and Client Assurance
- Administer the cybersecurity awareness training program (e.g., assigning courses, tracking completion, and reporting results).
- Conduct Third-Party Risk Management analysis, including review of vendor security documentation and recording of results.
- Complete security questionnaires and provide supporting documentation within agreed turnaround times.
- Perform other related duties as assigned by the client’s governance, risk and compliance leadership.
BASIC QUALIFICATIONS
- 3+ years of experience in security risk, governance, and compliance (GRC). Security operations or incident response experience with demonstrated GRC exposure (e.g., control assessments, audits, compliance reporting) will be considered.
- Working knowledge of the NIST Cybersecurity Framework and NIST SP 800-53, SP 800-30, and SP 800-39, with an understanding of the cybersecurity risk assessment process.
- Working knowledge of IT fundamentals, including networking, identity and access management (e.g., Active Directory), and cloud security (e.g., Microsoft Azure).
- Excellent written and verbal communication skills, with the ability to explain risk to technical and non-technical audiences.
- Strong organizational, interpersonal, and critical thinking skills, with the ability to manage multiple priorities under pressure, work independently, and collaborate with diverse teams.
- Sound judgment, high ethical standards, and the discretion to handle confidential client information.
- Ability to respond promptly to unplanned requests within agreed service-level expectations and to accurately estimate time and resources for projects.
- Commitment to continuous learning of new technologies, frameworks, and skills.
- Associate’s or Bachelor’s degree in information security, information technology, risk management, or a related field, or equivalent combination of education, certification, and experience.
- Relevant certifications preferred (e.g., CompTIA Security+, CISA, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, Microsoft SC-200 or AZ-500).
PREFERRED QUALIFICATIONS
- Law firm experience, including responding to client security questionnaires and reviewing outside counsel guidelines.
- Experience with a GRC platform (e.g., ServiceNow, RSA Archer) and with SIEM, vulnerability, or threat management tools (e.g., Microsoft Sentinel, Splunk).
- Scripting or automation experience (e.g., Python, PowerShell, KQL) to streamline recurring GRC reporting and data-gathering.
- Working knowledge of Claude, Legora, BitSight, and/or Prompt Armor.
LOCATION
Location: Palo Alto
650 Page Mill Road
Palo Alto
CA 94304-1050
US
The primary location for this job posting is in Palo Alto. The actual base pay offered will depend upon a variety of factors, including but not limited to the selected candidate’s qualifications, years of relevant experience, level of education, professional certifications and licenses, and work location. The anticipated pay range for this position is as follows: $116,875 – $158,125 per year.
The compensation for this position may include a discretionary year-end merit bonus based on performance. We offer a highly competitive salary and benefits package.
Benefits information can be found here.
Equal Opportunity Employer (EOE).
See All 14 Mid Level GRC Manager Jobs
Find roles that match your experience and apply in just a few clicks.
Find Mid Level GRC Manager JobsMid Level GRC Manager Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Retail
- Manufacturing
- Law & Legal Services
- Banking & Financial Services
Mid Level GRC Manager Jobs: Frequently Asked Questions
How do I get a mid level grc manager job?
Position yourself around ownership, not just participation. Highlight audits you led, frameworks you implemented, and risk decisions you made independently. Tailor your resume to show program-level accountability rather than task completion. Mid level grc manager roles go to candidates who demonstrate they can run a workstream with minimal oversight, so concrete outcomes and cross-functional collaboration carry more weight than credentials alone.
Which companies hire mid level grc managers?
Companies hiring mid level grc managers right now include TikTok USDS Joint Venture, Plaid, and Vercel, based on current listings on Migrate Mate as of November 2026. At this level, hiring comes from established enterprises with mature compliance functions as well as growth-stage companies building out their first formal GRC programs.
Are there remote mid level grc manager jobs?
Yes, and the share is substantial. About 9% of mid level grc manager openings are remote or hybrid as of November 2026, reflecting how compliance and risk work translates well to distributed teams. Many employers offer flexible arrangements at this level because GRC work centers on documentation, stakeholder meetings, and system-based reviews rather than on-site physical requirements.
How do I move up to a mid level grc manager role?
The path runs through deepening specialization and taking ownership of real programs over your first few years. Early-career work in audit support, policy documentation, or risk assessment gives you the foundation. What moves you to mid level is demonstrating you can lead assessments independently, manage relationships with business stakeholders, and produce compliance outputs that hold up under scrutiny. Measurable impact on control gaps or audit findings accelerates the transition.
Which industries hire the most mid level grc managers?
Mid Level grc manager roles concentrate in Technology & Software, Retail, and Manufacturing, based on current listings on Migrate Mate as of November 2026. These sectors drive hiring because they face layered regulatory obligations, audit cycles, and third-party risk requirements that demand experienced professionals who can manage programs without constant senior oversight.