GRC & Privacy Lead

About Polymarket

Polymarket is the world’s largest prediction market platform. It enables individuals to express views on real‑world events by trading on outcomes across politics, economics, sports, culture, and current affairs. Built as a peer‑to‑peer marketplace with no centralized “house,” Polymarket aggregates diverse opinions into transparent, market‑based probabilities that reflect collective expectations about the future. The platform traded $21 B in 2025 and is growing rapidly as an alternative news source.

About the Role

The IT and Security team is small, senior, and moves fast. This senior individual‑contributor role sits at the intersection of third‑party risk, audit execution, and privacy operations. You will own DSAR processing, vendor risk dispositions, and privacy impact assessments (PIAs), building new processes, making independent judgment calls, and documenting work for the team.

Responsibilities

• Triage vendor intake requests daily, assess inherent risk based on data sensitivity and system connectivity, and route appropriately—including flagging vendors that require PIAs or DPA review before onboarding.
• Analyze vendor assurance documentation (SOC 2 reports, ISO certifications, PCI AOCs, penetration test summaries) and produce clear written risk memos with defensible dispositions.
• Gather and organize evidence for the active SOC 2 Type II engagement, coordinate with control owners to close requests on time, and manage submissions through the auditor portal from start to finish.
• Process DSAR requests across multiple corporate entities, applying correct retention exemptions and routing logic, and track fulfillment to meet statutory deadlines.
• Run privacy impact assessments for new product features and vendor onboarding, working directly with product and engineering to identify risks before they ship.
• Maintain the policy library, track review and acknowledgment cycles, and own remediation tracking for vendor and audit findings through to resolution.
• Help implement and operationalize the privacy compliance platform, including building out the data inventory and mapping flows that reflect how personal data is collected and processed.

Requirements

• Hands‑on SOC 2 Type II audit experience—personally gathered evidence, coordinated with control owners, and managed auditor requests through a full engagement cycle.
• Demonstrated experience conducting third‑party vendor risk assessments, including reading and interpreting SOC 2 reports, PCI AOCs, and penetration test summaries, and writing risk memos with clear dispositions.
• Working knowledge of GDPR, CCPA/CPRA, BIPA, and CUBI, and the ability to translate those obligations into concrete process steps for product and engineering teams.
• Experience building compliance or privacy processes from scratch, not just inheriting and maintaining them.
• Comfort operating independently, triaging ambiguous situations, and making defensible decisions without waiting for escalation on routine assessments.
• Plus: Experience with PCI DSS scoping or self‑assessment activities.
• Plus: Familiarity with KYC and identity verification data flows and the privacy considerations specific to biometric and identity data.
• Plus: Prior experience at a crypto, fintech, or prediction market company.

Benefits

• Competitive salary & equity
• Unlimited PTO
• Full health, vision, & dental coverage
• 401(k) match
• Hardware setup: new MacBook Pro, big display, & accessories

Pay

Base salary range: $150,000 to $200,000 annually, plus equity and benefits. This range reflects a good‑faith estimate for this position; experience levels vary widely, so candidates whose expectations fall outside the range are still encouraged to apply.