GRC & Privacy Lead

About the Role

Polymarket's IT and Security team is small, senior, and expected to move fast. This role sits at the intersection of third-party risk, audit execution, and privacy operations — and the person in it will own all three. DSARs need to be processed, vendors need risk dispositions before they get access to our systems, and PIAs need to happen before engineering ships, not after.

This is a senior IC role. You'll make judgment calls independently, build processes that didn't exist before you arrived, and leave behind documentation the team can actually use. We have active audit work underway, a vendor pipeline that needs rigorous day-to-day management, and privacy obligations spanning GDPR, CCPA/CPRA, BIPA, CUBI, and the specific data flows that come with KYC and identity verification at scale.

What You'll Do

• Triage vendor intake requests daily, assess inherent risk based on data sensitivity and system connectivity, and route appropriately — including flagging vendors that require PIAs or DPA review before onboarding

• Analyze vendor assurance documentation — SOC 2 reports, ISO certifications, PCI AOCs, and penetration test summaries — and produce clear written risk memos with defensible dispositions

• Gather and organize evidence for our active SOC 2 Type II engagement, coordinate with control owners to close requests on time, and manage submissions through the auditor portal from start to finish