ZipRecruiter

Log In

1

Grc Sme Jobs (NOW HIRING)

Vanta

Product GRC Subject Matter Expert, (V4G)

$230K - $270K/yr

What you'll do as a V4G GRC SME at Vanta: * Build and own federal compliance frameworks - Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and ...

Vanta

Subject Matter Expert, GTM GRC - Revenue

$171K - $201K/yr

Serve as the dedicated GRC SME for a book of Strategic/Enterprise Account Executives: join discovery and qualification calls at the earliest deal stages, scope compliance programs against Vanta ...

Vanta Inc.

Serve as the dedicated GRC SME for a book of Strategic/Enterprise Account Executives: join discovery and qualification calls at the earliest deal stages, scope compliance programs against Vanta ...

New

Apply

Serve as the dedicated GRC SME for a book of Strategic/Enterprise Account Executives: join discovery and qualification calls at the earliest deal stages, scope compliance programs against Vanta ...

New

Vanta

Subject Matter Expert, GTM GRC - Revenue

$171K - $201K/yr

Serve as the dedicated GRC SME for a book of Strategic/Enterprise Account Executives: join discovery and qualification calls at the earliest deal stages, scope compliance programs against Vanta ...

Futurewave Systems

Oracle GRC Consultant

Tulsa, OK · On-site

$58 - $73/hr

GRC = Governance, Risk, & Compliance Advanced or Expertise with - Oracle eBusiness Suite --- GRC ... Description SME will support series of workshops, provide configuration guidance, develop approach ...

Q1 Technologies

Service Now SME

Bloomfield, NJ · On-site

Overview We are looking for a highly skilled ServiceNow SME/L3 to lead the design and governance of the ServiceNow platform across ITSM, ITOM, GRC, and Security Operations (SecOps). The SME will be ...

Purple Drive

Service Now SME

Bloomfield, NJ · On-site

Purple Drive We are looking for a highly skilled ServiceNow SME/L3 to lead the design and governance of the ServiceNow platform across ITSM, ITOM, GRC, and Security Operations (SecOps). The SME will ...

NR Consulting

Service Now SME

Bloomfield, NJ · On-site

Overview We are looking for a highly skilled ServiceNow SME/L3 to lead the design and governance of the ServiceNow platform across ITSM, ITOM, GRC, and Security Operations (SecOps). The SME will be ...

Scigon Solutions

GRC Specialist II

Chicago, IL · On-site

$116K - $144K/yr

GRC Specialist II Salary: $116,000-$144,000 As a Security GRC Specialist II , you'll be a key ... Security Consulting & SME Support: Serve as an Information Security subject matter expert, advising ...

next page

Showing results 1-20

All JobsTechnology JobsNetworking JobsApplication Security Specialist JobsGrc Sme Jobs

Grc Sme information

See salary details

$48

$69

$81

How much do grc sme jobs pay per hour?

As of Sep 9, 2026, the average hourly pay for grc sme in the United States is $69.97, according to ZipRecruiter salary data. Most workers in this role earn between $67.31 and $76.92 per hour, depending on experience, location, and employer.

What is a GRC SME?

GRC SMEs, or Governance, Risk, and Compliance Subject Matter Experts, are professionals who specialize in helping organizations manage their governance, risk, and compliance programs. They provide expert advice on regulatory requirements, risk management frameworks, and best practices to ensure an organization meets legal and industry standards. GRC SMEs often assess risks, develop policies, conduct audits, and support the implementation of compliance solutions. Their expertise helps organizations minimize risk exposure and maintain regulatory compliance in a rapidly changing business environment.

What are some common challenges faced by a GRC SME when implementing risk management frameworks across different departments?

A GRC SME often encounters challenges such as varying levels of risk awareness, resistance to change, and inconsistent processes across departments. Ensuring buy-in from stakeholders and adapting risk management frameworks to suit different business units requires strong communication and negotiation skills. Additionally, aligning organizational objectives with regulatory requirements while maintaining operational efficiency can be complex, but overcoming these challenges provides valuable experience and opportunities for professional growth.

What are the key skills and qualifications needed to thrive as a GRC SME, and why are they important?

To thrive as a GRC (Governance, Risk, and Compliance) SME, you need a deep understanding of regulatory frameworks, risk management methodologies, and compliance standards, often backed by a relevant degree and industry certifications like CISA, CISSP, or CRISC. Familiarity with GRC platforms such as RSA Archer, ServiceNow GRC, or LogicGate, as well as audit and risk assessment tools, is typically required. Strong analytical thinking, communication skills, and the ability to influence stakeholders are essential soft skills for this role. These skills ensure that organizations effectively manage risk, maintain compliance, and support strategic business objectives.

What are popular job titles related to Grc Sme jobs?

For Grc Sme jobs, the most frequently searched job titles are:

Grc Sme jobs near you
Infographic showing various Grc Sme job openings in the United States as of August 2026, with employment types broken down into 1% As Needed, 91% Full Time, 2% Part Time, and 6% Contract. Highlights an 80% Physical, 5% Hybrid, and 15% Remote job distribution, with an average salary of $145,541 per year, or $70 per hour.

Product GRC Subject Matter Expert, (V4G)

Remote

Vanta
See more jobs at Vantaexternal

$230K - $270K/yr

Full-time

Medical, Dental, Vision, Retirement, PTO

Posted 27 days ago

Job description

At Vanta, our mission is to help businesses earn and prove trust.We believe that security should be monitored and verified continuously, and we empower companies to practice better security and prove it with ease. Vanta has a kind and talented team, and while some have prior security experience, many have been successful at Vanta without it.
Vanta for Government (V4G) is how we bring that mission to the public sector. As federal compliance undergoes its biggest shift in a decade - FedRAMP 20x, machine-readable authorization, OSCAL - we're building the platform that turns federal frameworks into automated, continuously monitored product experiences. The GRC Subject Matter Experts on this team are the people who make that possible.
As Vanta's GRC Subject Matter Expert for V4G, you'll own federal compliance content used by every customer pursuing or maintaining federal authorization on our platform. This is an interpretation-and-authoring role, not a compliance program administration role: your job is to interpret underlying control requirements, identify where FedRAMP modifies or constrains the NIST framework, and translate those interpretations into precise, technically testable guidance that engineering can build and customers can act on. The content you write ships as product - a five-person startup and a Fortune 100 CSP both receive it - so calibrating depth, precision, and universality is the core craft.
You'll join Vanta's Security organization, which directly influences product development, facilitates the creation of automated GRC solutions for customers, and provides expert advisory services across the company.
What you'll do as a V4G GRC SME at Vanta:
  • Build and own federal compliance frameworks - Lead the creation, enhancement, and lifecycle management of controls, evidence requirements, and implementation guidance for FedRAMP (Low/Moderate/High), NIST SP 800-53, NIST SP 800-171, CMMC, DFARS, and StateRAMP. Author clear control rationales, acceptance criteria, and customer-facing guidance shipped as out-of-the-box product content.
  • Interpret controls at the mechanics level - Work fluently with 800-53A assessment procedures and 800-53B baselines; resolve organization-defined parameters and FedRAMP's constraints on them; decompose controls into distinct technical obligations; correctly resolve inherited, shared, and customer-owned responsibilities within a customer responsibility matrix; and anchor evidence expectations in authoritative artifacts (PPSM, STIG and CIS hardening standards and their scan outputs across operating systems, databases, network devices, and endpoints).
  • Author automated tests & continuous monitoring - Translate controls and infrastructure context (AWS GovCloud, Azure Government, GCP, SaaS, endpoints, CI/CD) into spec-level automated tests and detectors. Define test logic, data sources, edge cases, and - critically - failure conditions: how unapproved items, exceptions, missing data, and unevaluated resources affect a result. Pair with Engineering to implement and maintain detectors with versioned framework mappings.
  • Lead V4G's machine-readable future - Shape how Vanta's federal content is architected for OSCAL and FedRAMP 20x: machine-readable SSPs, config-as-compliance, and continuous authorization workflows.
  • Design crosswalks and mappings - Maintain bidirectional crosswalks across federal frameworks (800-53 ↔ 800-171 ↔ CMMC ↔ StateRAMP) with canonical control IDs, mapping confidence, and traceability to source authority.
  • Act as a product advisor across discovery & design - Partner with the V4G PM and Design on feature discovery, review UI/UX for control, evidence, and authorization workflows, and author PRDs and acceptance criteria grounded in agency, auditor, and 3PAO needs.
  • Enable AI-assisted compliance - Partner with Engineering/ML to design LLM-powered guidance and automation for federal workflows. Translate SME knowledge into machine-readable specs, define gold-standard evaluation sets, and implement quality and safety guardrails.
  • Synthesize feedback loops - Analyze input from customers, agencies, 3PAOs, and internal teams to identify content gaps and ship iterative updates quickly and safely.
  • Raise the bar - Mentor and calibrate other SMEs, set content quality standards for the federal portfolio, and set framework strategy that others execute against.

How to be successful in this role:
  • Experience - 8-10+ years in GRC and/or Information Security with hands-on federal compliance work: building or maintaining FedRAMP programs on the CSP side, authoring SSPs and supporting artifacts, and running continuous monitoring. DoD impact-level (IL4/IL5) or CMMC experience is a strong plus. Note: this is a builder role - candidates whose federal experience is primarily assessment (3PAO) or compliance program coordination will find the day-to-day is materially different from that work.
  • Federal interpretation depth - Demonstrated fluency with the NIST 800-53/FedRAMP relationship, 800-53A/B, organization-defined parameters, control inheritance vs. non-applicability, customer responsibility matrices, PPSM, and STIG/CIS benchmarks.
  • OSCAL & FedRAMP 20x - Working familiarity with OSCAL or other machine-readable compliance approaches, and an informed point of view on where federal authorization is heading.
  • Test-design rigor - Ability to turn a control into a functional test with defined pass and failure conditions, evidence sufficiency criteria, and coverage across relevant system components.
  • Product mindset - Ability to translate requirements into productizable capabilities usable by organizations of every size; comfort with experimentation and data-driven prioritization.
  • Technical & automation (AI-augmented) - Active, current use of AI in GRC work: AI pair-programming tools to accelerate specs, mappings, and test logic; lightweight automations across Sheets/Airtable, APIs, and webhooks; AI-augmented workflows (LLM-assisted control guidance, cross-framework mapping, evidence triage) with measured outcomes; and safe-use patterns for prompts and agents.
  • Analytical & detail-oriented - Precise control wording, mapping accuracy, and evidence specificity; comfortable in spreadsheets and large datasets.
  • Communication & collaboration - Excellent written and verbal skills; effective with engineers, designers, GTM teams, agencies, 3PAOs, and customers.
  • Self-motivated and independent - Operates autonomously at Lead level, setting direction rather than awaiting it.
  • Nice-to-have - StateRAMP, CNSSI 1253/ICD 503, GovCloud or IL-environment architecture experience, or prior product/content roles at a GRC platform.
  • Certifications (preferred, not required) - One or more of: CISSP-ISSEP, CISA, FedRAMP 3PAO assessor credentials (CCP/CCA), CISM, or equivalent experience.
  • Open to using AI to amplify their skills and strengthen their work - demonstrating curiosity, a willingness to learn, and sound judgment in applying AI responsibly to improve efficiency and impact.

What you can expect as a Vanta'n:
  • Industry-competitive salary and equity
  • Comprehensive medical, dental, and vision coverage, with 100% of employee-only benefit premiums covered for most medical plans
  • 16 weeks paid Parental Leave for all new parents
  • Health & wellness stipend
  • Remote workspace, internet, and cellphone stipend
  • Commuter benefits for team members who report to the SF and NYC office
  • Family planning benefits
  • Matching 401(k) contribution with immediate vesting
  • Flexible PTO policy, plus 80 hours of Sick Time
  • 11 company-paid holidays
  • Virtual team building activities, lunch and learns, and other company-wide events!
  • Offices in SF, NYC, London, Dublin, Tel Aviv, and Sydney

To provide greater transparency to candidates, we share base pay ranges for all US-based job postings regardless of state. We set standard base pay ranges for all roles based on function, level, and country location, benchmarked against similar-stage growth companies. Final offer amounts are determined by multiple factors and may vary based on candidate location, skills, depth of work experience, and relevant licenses/credentials.
#LI-remote
At Vanta, we are committed to hiring diverse talent of different backgrounds and as such, it is important to us to provide an inclusive work environment for all. We do not discriminate on the basis of race, gender identity, age, religion, sexual orientation, veteran or disability status, or any other protected class. As an equal opportunity employer, we encourage and welcome people of all backgrounds to apply.
About Vanta
We started in 2018, in the wake of several high-profile data breaches. Online security was only becoming more important, but we knew firsthand how hard it could be for fast-growing companies to invest the time and manpower it takes to build a solid security foundation. Vanta was inspired by a vision to restore trust in internet businesses by enabling companies to improve and prove their security. From our early days automating security monitoring for compliance standards like SOC 2, HIPAA and ISO 27001 to creating the world's leading Trust Management Platform, our vision remains unchanged.
Now more than ever, making security continuous-not just a point-in-time check- is essential. Thousands of companies rely on Vanta to build, maintain and demonstrate their trust- all in a way that's real-time and transparent.
Referral Instructions
If you are being referred for the role, please contact that person to apply on your behalf.

Apply