Spotify is seeking a Senior Security Governance, Risk, and Compliance (GRC) Manager to join the Security Studio who will work closely with our engineering teams and audit functions. You’ll be focused on handling the execution of tasks for the Security GRC Program within Spotify, primarily in relation to driving SOC 2 compliance, but also to other compliance and information security frameworks. You will work on ensuring tasks deliver high-quality value and are completed in a timely fashion. Additionally, you will play an integral part in recommending process improvements and in helping to implement these updates. This role will require a deep understanding of SOC 2 compliance, information security practices, as well as experience in working with technology teams.
What You'll Do
- Lead the SOC 2 compliance program and large-scale SOC 2 projects, identify dependencies, define success metrics and achievements, and ensure timely delivery
- Design, implement, monitor and maintain SOC 2 controls, while collaborating and building relationships with internal and external business partners
- Lead and handle all stages of SOC 2 audits, ensuring successful completion.
- Resolve appropriate scope of SOC 2 audits, encompassing new and existing service offerings, their supporting infrastructure, and associated processes.
- Lead and respond to customer security questionnaires while collaborating with internal teams, and drive questionnaire response automation
- Identify, assess, and advise on information security risks, processes and controls to a variety of business partners
Who You Are
- You have 5+ years of experience with SOC 2 compliance, including leading a SOC 2 compliance program, controls design, and implementation. Experience in the technology industry is preferred.
- You have 5+ years of experience with security frameworks, e.g. SOC 2, ISO27001, NIST CSF, PCI-DSS, etc., security controls design and implementation, and security best practices
- Prior IT Audit experience in areas of SOC 2, ITGC, SOX are preferred
- CISA, CISM, CISSP or other related certifications are preferred but not required.
- You have experience with privacy frameworks, such as GDPR or CCPA
- You are a strong collaborator, with experience working on teams composed of both technical and non-technical members
- You have a demonstrated ability to lead large projects, problem-solve, multitask, and have excellent organizational skills
- You have excellent written and verbal communication skills, with experience presenting to key stakeholders and partnering with internal collaborators and external auditors
- You thrive in a data-driven, fast-paced and innovative environment
Where You'll Be
- For this role you will be in Stockholm.
