GRC Manager

At JFrog, we’re reinventing DevSecOps to help the world’s greatest companies innovate. Our team of industry-leading software security experts is a true pioneer, constantly pushing the boundaries with original research and technological innovation. JFrog is a special place with a unique combination of brilliance, spirit, and just all-around great people. Thousands of customers, including the majority of the Fortune 100, trust JFrog to manage, accelerate, and secure their software delivery from code to production – a concept we call “liquid software”. Wouldn't it be amazing if you could join us on our journey?

We are seeking an experienced GRC Manager (Governance, Risk, and Compliance) to lead and mature key areas of JFrog’s global Governance, Risk, and Compliance program. This role will manage members of the GRC team, including the GRC Specialist, and will be responsible for driving JFrog’s corporate compliance, customer assurance, risk management, audit readiness, and trust programs. The GRC Manager will work closely with Security, IT, Legal, Privacy, Sales, R&D, Finance, Internal Audit, and other business stakeholders to ensure JFrog maintains a scalable, risk-based compliance program that supports both regulatory obligations and customer expectations. The ideal candidate combines strong cybersecurity and compliance expertise with leadership, business judgment, project management, and the ability to translate complex compliance requirements into practical business solutions.

• Lead and develop GRC team members, including the GRC Specialist, by establishing priorities, providing guidance, reviewing deliverables, and supporting professional development.
• Own and mature key components of JFrog’s global GRC program, ensuring governance, policies, controls, risk-management activities, and compliance processes remain effective and scalable as the company grows.
• Manage and support security certifications, attestations, and compliance programs, including ISO 27001, SOC 2 Type II, and other applicable industry and regulatory frameworks.
• Lead internal and external audit activities, coordinating evidence collection, stakeholder participation, remediation activities, and responses to auditors, assessors, customers, and other external parties.
• Lead and mature the Third-Party Risk Management (TPRM) program, overseeing third-party security assessments, risk identification and treatment, remediation tracking, risk acceptance, ongoing monitoring, and reporting to ensure third-party risks are appropriately identified and managed.
• Drive policy and control governance, ensuring JFrog policies, procedures, standards, and controls remain aligned with applicable regulatory requirements, contractual commitments, business objectives, and industry best practices.
• Partner with Sales and customer-facing organizations to improve compliance enablement, develop reusable resources, to help the Customer Trust team efficiently respond to security and compliance requirements from prospective and existing customers.
• Identify opportunities to automate and scale GRC processes, including the use of GRC platforms, trust-center technologies, workflow automation, and AI-enabled solutions.
• Monitor regulatory, industry, and customer-driven changes and assess their potential impact on JFrog's compliance obligations, controls, and GRC roadmap.
• Establish and track GRC metrics and KPIs, providing management with visibility into compliance posture, audit findings, customer assurance activities, risks, remediation efforts, and program maturity.
• Drive remediation efforts across the organization, working with control owners to ensure identified gaps, audit findings, risks, and corrective actions are appropriately prioritized and resolved.
• Serve as a trusted GRC advisor to business and technical stakeholders, translating complex regulatory and compliance requirements into practical, risk-based recommendations.
• Support the continued development of JFrog’s global compliance strategy, identifying emerging risks, customer requirements, and opportunities to strengthen the organization’s security and compliance posture.

• 5+ years of experience in cybersecurity governance, risk, compliance, security assurance, audit, or a related field, with increasing levels of responsibility.
• Prior experience leading or managing GRC professionals, projects, or significant cross-functional compliance initiatives.
• Strong hands-on knowledge of ISO 27001 and SOC 2 Type II, including experience supporting or leading audits and certification activities.
• Strong knowledge of cybersecurity and risk-management frameworks such as NIST, ISO 27001/27002, CSA CCM/CAIQ, SIG, and related industry standards.
• Familiarity with privacy and regulatory requirements such as GDPR, CCPA/CPRA, and ISO 27701.
• Experience performing or managing cybersecurity risk assessments, documenting risks, working with risk owners, and tracking remediation.
• Experience working with external auditors, assessors, customers, regulators, and internal stakeholders.
• Strong understanding of cloud environments and SaaS security and compliance considerations.
• Experience implementing, administering, or optimizing GRC, trust-center, audit-management, or compliance automation tools.
• Demonstrated ability to manage multiple complex initiatives simultaneously and drive projects to completion across geographically distributed teams.
• Excellent written and verbal communication skills, including the ability to communicate cybersecurity and compliance topics to technical teams, business leaders, customers, and executives.
• Strong analytical, organizational, and project-management skills.
• A self-driven, collaborative approach with the ability to operate effectively in a fast-paced and rapidly evolving technology environment.
• Professional certifications such as CISA, CISM, CRISC, CISSP, CCSK, ISO 27001 Lead Auditor/Lead Implementer, or similar certifications - An Advantage
• Experience working within a global SaaS, cloud, cybersecurity, or DevSecOps organization - An Advantage
• Experience with additional compliance frameworks or regulations, such as PCI DSS, NIST CSF, NIST 800-53, FedRAMP, CMMC, DORA, NIS2, or the EU Cyber Resilience Act - An Advantage

• Experience building or scaling GRC programs in a rapidly growing global organization - An Advantage
• Experience with compliance automation, AI-enabled GRC tools, trust-center platforms, and continuous control monitoring - An Advantage
• Experience partnering directly with enterprise Sales, Legal, Product, Engineering, and Security teams - An Advantage