Head of Governance, Risk & Compliance

About the role

Own Guava's governance, risk, and compliance program end to end: our SOC 2 Type II, HITRUST i1, and PCI DSS Level 1 certifications; the enterprise risk register; our policy and controls framework; and Guava's AI governance program. You will partner closely with engineering to design and implement controls, and with sales and product to build the guardrails that keep our customers compliant with TCPA, FCC, and GDPR obligations. You own our security questionnaires and RFIs, our annual training program, and our incident tabletop exercises, and you serve as a trusted advisor to leadership on risk and regulatory questions.

Build something foundational. Voice AI is moving fast, and the companies that win will be the ones customers trust. You will own a critical part of that trust. Real ownership. Build and own Guava's entire GRC and compliance function as a first-class program. Engineering-led culture. We value people who go deep, ship, and take end-to-end ownership, with the support of a tight, senior team. In-person and collaborative. Our DTLA office is where we design, whiteboard, and build together, in a growing LA tech scene.

Responsibilities

• Own certifications. Own the annual compliance plan and lead the SOC 2, HITRUST, and PCI DSS programs: scoping, evidence collection, control design, and gap remediation.
• Run audits end to end. Lead and organize audit activities (evidence collection, stakeholder interviews, and remediation follow-up) and keep audit-ready artifacts maintained across frameworks.
• Manage control deficiencies. Analyze deficiencies from reviews and audits, communicate findings clearly, and drive diligent follow-up to resolution.
• Own the enterprise risk register. Maintain it end to end: risk intake, triage, inherent and residual risk scoring, and risk-treatment decisions with risk owners.
• Own the controls framework. Maintain a common, harmonized controls framework mapped across SOC 2, HITRUST, PCI DSS, and related frameworks to reduce duplicate effort and scale audit readiness.
• Run policy governance. Own the full policy lifecycle (creation, review, approval, publication, retirement) along with documentation standards and exception governance.
• Implement controls with engineering. Translate framework requirements into real, testable technical and operational controls embedded in the SDLC.
• Stand up AI governance. Maintain