# Director - Governance, Risk, Compliance & Privacy (GRC) at Beacon

- Company: Beacon
- What the company does: Beacon acquires and grows essential businesses. With our centralized platform, we empower founders with the technology and expertise to better serve their customers. Backed by General Catalyst.
- Company website: https://beaconsoftware.com/
- Type: Startups
- Level: Principal and up
- Location: San Francisco, CA
- Work setup: Remote
- Posted: 2026-09-09
- Apply by: 2026-10-24
- Apply: https://jobs.ashbyhq.com/beaconsoftware/aa18aaa1-7d79-489e-b888-1b046d010d51
- Page: https://www.1752.vc/careers/jobs/beacon-director-governance-risk-compliance-and-privacy-grc/

## About the role

Our GRC function is at an early, formative stage. You would shape it from the foundations and scale it across the portfolio, working directly with our portfolio companies to take them through their own audits and certifications, and designing a program that grows with the business rather than one built for a single audit. The mandate spans security compliance, data privacy, risk, and AI governance. We expect it to be built AI-first: modern automation platforms and LLM-assisted workflows over manual process.

## What they're looking for

- You have built or substantially matured a GRC program before and taken an organization through SOC 2 Type 2. Typically several years (5+) in GRC, IT governance, or security compliance, though what you have built matters more to us than the count
- A builder with a bias for action. When you see a manual process, your first instinct is how to automate it
- A strong systems thinker. You design scalable GRC architectures, not one-off fixes for the next audit
- Fluent with a compliance automation platform (Vanta, Drata, Secureframe, or similar) and current on AI tooling in practice, not just in theory
- Comfortable across both security compliance and data privacy, or able to ramp quickly on regimes you have not personally run
- An excellent cross-functional communicator who works through influence and can translate compliance requirements into terms both technical and non-technical teams can act on

Tags: GRC / IT / Security