GRC technology build vs buy: hiring the GRC platform owner
OneTrust, Archer, ServiceNow GRC, MetricStream, LogicGate - the platform decision drives the hire. Or the other way around.
# GRC technology build vs buy: hiring the GRC platform owner
Most growth-stage EU regulated firms reach a point where compliance, risk and audit can no longer run on spreadsheets and Confluence. The decision is whether to buy a GRC platform (OneTrust, Archer, ServiceNow GRC, MetricStream, LogicGate, Vanta for SaaS-leaning shops) or build something focused.
That decision is downstream of the hire, not upstream. The right GRC platform owner has a clear opinion on which option fits your situation - and the receipts to back the recommendation.
What this role actually owns
- **Vendor selection or in-house design** for the GRC platform.
- **Data model** - controls, evidence, frameworks, risks, issues, attestations.
- **Integrations** with the AML / sanctions screening stack (ComplyAdvantage, NICE Actimize, Napier, Featurespace, Lucinity), the IAM stack, the SIEM.
- **Reporting** to Risk Committee, Audit Committee, and the supervisor.
- **Uptime / SLOs** on whichever pipeline runs through the platform.
Hiring patterns that work
1. **The product engineer with a GRC tour of duty.** Bridges engineering / risk culture, can build or buy. 2. **The risk technologist from a Tier 1 bank.** Knows the enterprise-grade tools, can ship; risk: over-engineers for the stage. 3. **The fintech compliance lead who shipped a custom system.** Can build; risk: opinionated against any vendor without good reason.
Screening questions
- *"Talk me through the last GRC platform decision you made. Build vs. buy - what did you choose, and what did you reverse 12 months later?"*
- *"Pick one integration in your current stack and describe the most painful failure mode."*
- *"How do you justify a GRC platform spend to a CFO?"*
Red flags
- Names vendors but cannot speak to false-positive rates or operational data quality.
- Has only ever bought, never built - or only built, never bought.
- Treats GRC tooling as a procurement exercise rather than a fit exercise.
[Submit a brief](/submit-hiring-brief) when you are ready to commission this role.