Spotify is seeking a Senior Security Governance, Risk, and Compliance (GRC) Manager to join the Security Studio who will work closely with our engineering teams and audit functions. You’ll be focused on handling the execution of tasks for the Security GRC Program within Spotify, primarily in relation to driving SOC 2 compliance, but also to other compliance and information security frameworks. You will work on ensuring tasks deliver high-quality value and are completed in a timely fashion. Additionally, you will play an integral part in recommending process improvements and in helping to implement these updates. This role will require a deep understanding of SOC 2 compliance, information security practices, as well as experience in working with technology teams.What You'll Do Lead the SOC 2 compliance program and large-scale SOC 2 projects, identify dependencies, define success metrics and achievements, and ensure timely deliveryDesign, implement, monitor and maintain SOC 2 controls, while collaborating and building relationships with internal and external business partnersLead and handle all stages of SOC 2 audits, ensuring successful completion.Resolve appropriate scope of SOC 2 audits, encompassing new and existing service offerings, their supporting infrastructure, and associated processes.Lead and respond to customer security questionnaires while collaborating with internal teams, and drive questionnaire response automationIdentify, assess, and advise on information security risks, processes and controls to a variety of business partnersWho You Are You have 5+ years of experience with SOC 2 compliance, including leading a SOC 2 compliance program, controls design, and implementation. Experience in the technology industry is preferred.You have 5+ years of experience with security frameworks, e.g. SOC 2, ISO27001, NIST CSF, PCI-DSS, etc., security controls design and implementation, and security best practicesPrior IT Audit experience in areas of SOC 2, ITGC, SOX are preferred CISA, CISM, CISSP or other related certifications are preferred but not required.You have experience with privacy frameworks, such as GDPR or CCPA You are a strong collaborator, with experience working on teams composed of both technical and non-technical membersYou have a demonstrated ability to lead large projects, problem-solve, multitask, and have excellent organizational skillsYou have excellent written and verbal communication skills, with experience presenting to key stakeholders and partnering with internal collaborators and external auditors You thrive in a data-driven, fast-paced and innovative environmentWhere You'll Be For this role you will be in New York.