About Mercor

Mercor’s mission is to organize human intelligence for the AI economy. We build the infrastructure that enables frontier AI labs and enterprises to train, evaluate, and improve AI on real-world professional work. More than five million experts have joined our network, and we pay out over $5 million daily for their knowledge and expertise.

We built our training and evaluation infrastructure alongside the world’s leading AI labs. Now, we’re bringing those capabilities to enterprises across industries, enabling them to train, evaluate, and improve AI using their own expertise and standards. Our APEX benchmarks measure how AI performs on economically valuable work, while our enterprise evaluations and post-training capabilities turn those insights into measurable improvements across real-world workflows.

Our work sits at the intersection of frontier AI, human expertise, and real-world application. We’re solving problems few companies have encountered, with the opportunity to influence what the world’s most advanced AI systems become capable of doing. We’re looking for people who bring different perspectives, take ownership, exercise sound judgment, and hold themselves to an exceptionally high standard. You’ll have the opportunity to do consequential work alongside talented colleagues who challenge one another, collaborate openly, and share a commitment to excellence.

Mercor is profitable and recently raised a $750 million Series D at a $20 billion valuation. We work in person five days a week in San Francisco, New York, and London.

Role Description

You'll be the first GRC hire at a company that processes some of the most sensitive data on earth: training data, evals, and human-feedback pipelines for the frontier AI labs, plus payments and KYC for 300K+ experts.

This is not an audit-theater role. You'll own the operating cadence of a continuously-audited company: continuous SOC 2 monitoring, the active ISO 27001 buildout, an annual customer audit every quarter, and a sub-48-hour questionnaire SLA. You'll write controls in code where it makes sense, push back on tools that fight you, and own the artifacts that close enterprise deals.

We use AI heavily in our own GRC work. You should be comfortable using LLMs to draft, review, and respond at speed. If you've ever copy-pasted the same answer into 14 vendor questionnaires by hand, you'll appreciate not having to.

We're in-person five days a week at our SF headquarters, with first Fridays remote.

What You'll Build

The Mercor compliance operating cadence: SOC 2 Type 2 (continuous), ISO 27001 (standing up now), and the next two frameworks customers ask for (HIPAA, FedRAMP Moderate, EU AI Act conformity - your call on sequencing)

A customer-audit machine that responds tocustomers

The third-party risk program - formal intake, recurring review cadence, evidence requirements - tied into procurement so vendors can't be onboarded around it

Policy lifecycle owned end-to-end: version, attestation, exception handling, review cycle - not a SharePoint graveyard

Controls-as-code where it makes sense: integrations, policy packs, rules tied to SOC 2 CC categories, automated evidence collection

Data-handling procedures: the customer-data-deletion gap, DSAR workflow, KMS scheduled destruction, offboarding handlers

The internal trust narrative: customer trust pages, security one-pagers, executive-ready disclosure templates when something goes sideways

What We're Looking For

7+ years in security GRC, compliance engineering, or audit, with at least 2 years owning a SOC 2 Type 2 program end-to-end at a company under audit by enterprise customers

You've shipped at least one ISO 27001 certification from kickoff to issued certificate, including Stage 1 and Stage 2 with a real registrar

Fluent in Vanta (or Drata, Secureframe, Sprinto) at the integration and admin level, not just the reviewer UI - you've configured connectors, written custom tests, debugged broken evidence

You translate cloud-security language to auditor language and back without losing precision - you can read a Wiz finding, a Panther rule, an IAM policy, and say what control it maps to