About Blue J

A Note on Location

The Opportunity

What You’ll be Doing

• Own security questionnaires / sales surveys end‑to‑end to help Sales move quickly and confidently.
• Support our annual SOC 2 Type 2 activities (evidence collection, control monitoring, audit coordination) and applicable privacy regulation obligations (such as GDPR/UK GDPR, PIPEDA, CCPA/CPRA, etc.).
• Monitor emerging AI-related laws and compliance frameworks to ensure Blue J remains aligned with evolving AI governance requirements; contribute to developing internal readiness in this rapidly growing regulatory space.
• Perform vendor due diligence (new & existing vendors/sub‑processors), assess risk, document findings, and track remediation; maintain the vendor inventory.
• Maintain and improve policies & procedures (security, privacy, incident response, acceptable use, access, etc.), ensuring versions, ownership, and review cadence are clear.
• Risk analysis & risk register: run/refresh risk assessments, rate risks, propose controls, and report on trends and treatment status.
• Contract reviews with Legal (e.g., security/privacy clauses in MSAs, DPAs, SCCs as applicable); provide clear, business‑savvy guidance to Sales and customers.
• Document and tune the Incident Response plan; schedule exercises/tabletops and track follow‑ups.
• Customer‑facing communication: join prospect and customer calls to explain our program in plain language and instill confidence.
• Metrics & hygiene: define and report GRC KPIs/SLOs (e.g., questionnaire turn‑around time, evidence completion, vendor reviews on time).
• Continuous improvement: identify pragmatic process upgrades that save time, reduce risk, and scale with growth while staying hands‑on in daily execution.

What You Offer Blue J

• 5 plus years in GRC or closely related roles, with a bias for action and comfort working as a doer in a lean team.
• Proven experience shipping outcomes across SOC 2 Type 2 and at least one privacy regime (e.g., GDPR/UK GDPR, PIPEDA, CCPA/CPRA).
• Strong background in vendor due diligence/TPRM, policy management, and risk assessment.
• Comfortable reading and commenting on contractual language related to security & privacy (DPAs, data protection clauses) in partnership with Legal.
• Excellent written and verbal communication, including the ability to simplify complex security topics for customers and internal stakeholders.
• Experience in B2B SaaS, ideally startup/scale‑up environments serving regulated or enterprise customers.
• Tooling familiarity with Drata, Vanta, and Jira, and other collaboration tools.

What We Offer You

• A rare opportunity to be an early team member shaping our security and compliance with visible business impact.
• We are leading the generative AI tax research market with an exciting product in a virtually untapped market, amidst significant buzz about our work.
• We are flexible! Work remotely most of the time and drop by our downtown Toronto office to connect with the team whenever you’d like.
• We’re well-funded and offer competitive base salaries and stock options. You’ll play a crucial role in our growth, and it’s important to us that you share in our long-term success.
• We care about you as a whole person, not just an employee. Our thoughtfully designed benefits package covers you and your family, and we work hard to maintain a healthy work/life balance.
• We’ve got an amazing team. We’re mission-driven and motivated by success, but we’re friendly, we’re collaborative, and we care about each other.
• We’ve got all the start-up perks you’d expect, and are intentionally building a culture where you can feel safe to be yourself at work, and watch your career grow because your team has invested in you.

The Core Values that Define Our Culture

• We are customer-focused
• We put the team interest before self-interest
• We are pleasant and playful
• We are open to better ideas
• We deliver on our promises
• We solve the toughest problems

What to Expect in the Interview Process

• Chat with Lavita, Talent Acquisition Manager
• Meet Troy, Security and Compliance Manger
• Panel with Matt, Cloud Lead, and Avi B, COO
• Engineering team conversation
• Meet Ben, CEO