Staff GRC Specialist

About the Role

Jeppesen ForeFlight is seeking a Security Assurance & Operations leader to own two critical functions within our Governance, Risk, and Compliance organization. This role serves as the single point of contact for all customer-facing security inquiries (including HECVAT, SIG, CAIQ, customer audits, and agency-specific questionnaires) while also supporting the operational governance of our compliance program to ensure documentation remains current and audit-ready between cycles.

As Jeppesen ForeFlight continues to grow its enterprise and public-sector customer base, the volume and complexity of security-related requests from customers, procurement teams, and government agencies has grown with it. This role is purpose-built to ensure those requests are handled with speed, consistency, and accuracy to protect both our customer relationships and our ability to compete in security-sensitive markets. This role reports directly to the Director of GRC with dotted-line working relationships across the Proposals Team, Sales, Engineering, Legal, and Product Security. This position is 100% remote, US-based. Limited travel may be required; not estimated to exceed 10% of the employee's time.

Position Responsibilities

• Serve as the single named point of contact for all inbound customer security questionnaires, assessment requests, customer audits, and agency-specific security inquiries routed to the Security Team
• Establish and own a structured intake, tracking, and response process for all customer-facing security requests to ensure consistent turnaround timeframes, clear ownership, and a single escalation path to support Sales.
• Lead completion of standard and custom security questionnaires including HECVAT, SIG, CAIQ, and customer-specific DDQs with appropriate SME input, owning each request through to delivery
• Own the security Q&A content within the organization's enterprise questionnaire management platform to ensure responses remain accurate and aligned with current security posture
• Manage Trust Center operational updates to reflect current certifications, policies, and security posture; handle customer requests for security documentation through appropriate NDA-gated channels
• Partner with the Proposals Team to embed security intake steps within existing proposal workflows, ensuring a seamless and consistent experience for Sales and customers
• Produce quarterly metrics on inquiry volume, response time, content reuse rates, and document review completion status for GRC leadership review
• Communicate effectively across Sales, Proposals, Engineering, Legal, and Product Security; represent GRC in cross-functional meetings and serve as an informal mentor to colleagues navigating customer security requests
• Coordinate with control owners and GRC team members to ensure policy documentation, procedures, and framework evidence remain current between audit cycles

Basic Qualifications (Required Skills / Experience)

• Bachelor's degree or equivalent experience in a technical, business, or compliance-adjacent field
• 4+ years in a proposal management, GRC, security compliance, or combined assurance function with hands-on operational ownership of both process and content
• Direct, hands-on experience completing SIG, CAIQ, HECVAT or comparable vendor security questionnaires at volume in a B2B SaaS or enterprise technology environment
• Advanced working experience with an enterprise RFP or questionnaire management platform
• Strong system thinking with the ability to establish and run security intake and tracking cross-functionally without formal authority
• Experience with AI-assisted workflows or platform integrations that accelerate response cycles and reduce manual effort
• Strong written and verbal communication skills along with the ability to translate technical security concepts into clear, accurate, customer language
• Strong organizational discipline is required to manage a high volume of concurrent requests, review cycles, and deadlines with precision
• Comfortable producing metrics and status reporting for leadership on inquiry performance and program health

Preferred Qualifications

• Experience in a high-growth B2B SaaS or technology company where security questionnaires are high-volume, time-sensitive, and directly tied to revenue and renewal outcomes
• Experience building or scaling a centralized security Q&A knowledge base across cross-functional subject matter experts
• Background supporting government or public-sector customers with procurement, renewal, or compliance documentation requirements
• Security, compliance, or industry certification relevant to the role (e.g., Responsive platform certification, Fortinet NES, cloud networking, or similar)
• Responsive or equivalent RFP platform certification or advanced administration experience
• Familiarity with security and compliance frameworks (ISO 27001, SOC2, NIST, etc.) to interpret control questions and coordinate accurate responses
• Familiarity to aviation, aerospace, or defense-adjacent compliance frameworks including EASA, CASA, or CMMC. 

Why Join Us 

At Jeppesen ForeFlight, we know you want a rewarding career. To do that, you need challenging projects, a good work environment, and awesome coworkers. We believe in our employees, and we empower them to make a direct impact on our products and services. We strive to provide our employees with a world-class benefits experience, focused on supporting their physical, financial, and emotional wellbeing. Our benefits package includes but is not limited to the following:

• Medical, dental, vision insurance with Employer paid health premiums
• Open PTO Policy
• 401(k) with up to 10% company matching and immediate vesting
• 12 Weeks Paid Paternal Leave
• Flight Training Rewards

Pay is based upon candidate experience and qualifications, as well market and business considerations: Summary Pay Range: 

Jeppesen ForeFlight - EOE including Disability/Vets | Pay Transparency | E-Verify Participant | Equal Opportunity Employer