Director, Governance Risk & Compliance

Leads Figma's Governance, Risk and Compliance team, setting and owning the company's whole approach to security compliance, risk and governance. The director manages and grows a team of GRC professionals, represents the function to executives, the board, customers and regulators, and can work from a US hub or remotely in the United States.

The role sets the GRC strategy and roadmap in step with company goals and the security leadership team, and owns every certification Figma holds or needs, among them SOC 2, ISO 27001, FedRAMP, SOX ITGC and GDPR, widening coverage as Figma reaches new markets and customer segments. The director builds enterprise risk and controls frameworks that scale, including AI governance work and ongoing monitoring of control effectiveness, manages external auditors, assessors and regulators through each audit cycle, chooses and tunes GRC tooling, and keeps security policies and standards current. Working with Sales, Legal and Customer Trust on questionnaires, customer audits and contracts is part of the job, as is reporting risk posture and audit readiness to executive and board audiences.

Figma wants ten or more years in information security, compliance or risk, at least four leading a GRC, security or compliance team, deep hands-on SOC 2 and ISO 27001 experience across several audit cycles, and a record of building or scaling GRC programmes at a fast-growing SaaS company, including public-company SOX ITGC work. FedRAMP experience and CISSP, CISA, CISM or CRISC are pluses.