Security Architect & GRC Lead

LawVu is the AI-native operating system for in-house legal - the foundational layer that powers the entire legal function. Our intelligent platform connects legal intake, matters, contracts, spend, and reporting in one connected workspace, enabling legal teams to work smarter, move faster, and deliver measurable business value.

Trusted by leading organizations including Discord, Employment Hero, Etsy, and many more, LawVu is helping legal teams transform from reactive service providers into strategic business partners.

Founded in New Zealand, LawVu is a fast-growing global software company with customers and employees across North America, Europe, Australia, and New Zealand. Backed by leading venture capital firms, including Insight Partners and Airtree Ventures, we're creating a new category of LegalOS software purpose-built for modern in-house legal teams.

This is a hands-on, strategic role in the Legal, Risk and Compliance team. You’ll partner closely with our product, engineering and go to market teams, and execute high-impact initiatives designed to ensure our product is meeting industry best practice approaches to security. You will be an expert who is deeply connected to our product and risk profile, so you can deliver projects that move the needle for our compliance program.

We're looking for a Security Architect & GRC Lead to own the strategy and direction of information security across the LawVu business and the LawVu Platform. This is a senior role for someone who can set the security architecture, support maturing our governance and compliance program, and move the security agenda forward, including how we securely and safely deploy AI within our products.

You'll define the framework, standards, and roadmap; support the Business Support Specialist and run the day-to-day operational and audit work. You'll sit within Legal, Risk & Compliance and partner closely with Engineering, Product, and the commercial teams.

What you'll own

Security strategy & architecture

-Own the information security strategy, standards, and roadmap for the business, partnering closely with the Platform Engineering team to embed security work into the Platform roadmap

-Provide security architecture oversight and governance, partnering with Engineering and Product to ensure solutions align with LawVu 's security requirements and secure-by-design principles. Champion application and product security practices, including secure SDLC, architecture reviews, threat modelling, vulnerability management, and security requirements for new platform capabilities

-Own security governance: policies, standards, and the risk management framework (risk register, assessments, and treatment).

Security compliance direction

-Own the continuous maturity of LawVu 's security compliance program, including ISO 27001 and SOC 2 (Type II).

-Define the control framework and audit strategy and own auditor relationships at a strategic level.

AI security & safety

-Support LawVu 's approach to building and deploying AI features securely and responsibly, in partnership with the AI Governance function.

-Address AI-specific risks - model and LLM integration security, agentic and MCP integrations, prompt injection, data leakage, and AI supply-chain risk.

-Contribute security architecture and risk perspective to AI impact assessments and product risk determinations.

Third-party, data protection & incident readiness

-Set the approach for third-party / vendor security risk, incident response, and business continuity / disaster recovery.

-Partner with privacy and legal on data protection, breach management, and customer data commitments.

Customer trust

-Act as the senior security voice on strategic customer and prospect engagements.

-Own the direction of the customer trust program (trust documentation, RFP and due-diligence strategy), with the Business Support Specialist executing day-to-day.

What you'll bring

-Proven experience leading information securi