23 days ago
Base Salary
$150k - $170k/yr
Responsibilities
- Design framework crosswalks and control mappings across PCI DSS, SOC 1 Type II, ISO 27001, HITRUST, and NIST CSF/800-53 using OSCAL.
- Own the Master Control List, including control nomenclature, relational database architecture, evidence linkages, and ongoing maintenance.
- Manage the lifecycle of controls, evidence requirements, and implementations as standards, requirements, and organizational scope change.
- Build evidence-collection workflows and compliance automation in GRC tooling.
- Partner with Security Engineering, Legal, and Finance to translate control designs into actionable engineering and product guidance.
- Design and maintain AI-powered GRC tooling and multi-agent pipelines for risk quantification, evidence automation, vendor risk assessment, and compliance monitoring.
- Identify opportunities to rationalize controls and reduce duplicate work across compliance frameworks.
Requirements
- 6+ years of experience in security engineering, GRC, or compliance engineering with hands-on work across multiple regulatory frameworks.
- Deep working knowledge of PCI DSS, SOC 1 or SOC 2, HITRUST, and at least one of ISO 27001 or NIST CSF/800-53.
- Experience designing or maintaining control frameworks, crosswalks, or unified control architectures.
- Hands-on experience managing evidence requirements and control implementation.
- Proficiency with compliance automation tools such as Optro, Drata, Vanta, Hyperproof, or Anecdotes.
- Ability to translate technical control design into clear guidance for engineering and product teams.
- Experience building or operating production or near-production agentic AI workflows, LLM-based pipelines, multi-agent systems, or RAG architectures.
- Experience with AWS Lambda, Step Functions, EventBridge, S3, and Aurora/RDS is preferred.
- Experience supporting external audits, harmonizing controls across multiple brands or acquisitions, or working in SaaS or consumer marketplace environments is preferred.
- Certifications such as CISA, CISSP, ISO 27001 Lead Implementer, CCSFP, or PCI ISA are preferred.
Benefits
- Base salary range is $150,000 to $170,000 in the United States, with potential performance bonus, benefits, and other incentive compensation.
- The company is an Equal Opportunity Employer and encourages applicants from diverse backgrounds.
About ClassPass
ClassPass builds a subscription marketplace for fitness and wellness, letting consumers book classes at gyms, studios, salons, and spas using app-based credits. It sells memberships to individuals and corporate wellness programs to employers, and drives demand for partner venues through revenue-sharing bookings. Founded in 2013 in New York and acquired by Mindbody in 2021, it operates across multiple countries.