Governance, Risk, Compliance & Trust Analyst

Compliance

• Support audit readiness across core frameworks such as FedRAMP, SOC 2, and ISO 27001/27017/27018 by organizing evidence, maintaining documentation quality, and partnering with control owners to close gaps.
• Manage compliance operations including evidence requests, policy and procedure updates, control narrative maintenance, and recurring review cycles.
• Partner cross-functionally with Security Engineering, DevOps, IT, Legal, People, Procurement, and other stakeholders to gather inputs, validate implementation details, and produce audit-ready outputs.
• Maintain strong execution against defined compliance SLAs, milestones, and recurring obligations, escalating risks early.
• Translate technical, operational, and regulatory topics into clear written deliverables for internal and external audiences.
• Support internal risk and governance processes, including security impact analyses, change-related compliance reviews, and other structured review workflows.
• Contribute to the operation of the Public Sector Clearance Program, guiding cohorts, maintaining status, tracking issues, and communicating updates.

Customer Trust

• Manage customer security questionnaires, trust inquiries, and diligence requests with minimal supervision, including researching answers, validating claims, gathering evidence, and producing accurate responses.
• Maintain and improve customer-facing trust content across repositories, trust portals, knowledge resources, and standard response libraries.
• Partner with Security Engineering, DevOps, Legal, GTM, Product, IT, and other stakeholders to collect inputs and ensure responses reflect current implementation.
• Maintain execution against trust-related SLAs including turnaround time and response quality.
• Identify gaps in trust materials and proactively drive updates.
• Support trust enablement initiatives including trust center improvements, evidence library maintenance, and process improvements.
• Use workflow data to identify recurring concerns and recommend changes to content, process, or tooling.

Vendor Reviews

• Own end-to-end delivery of moderately complex vendor review workstreams including intake, scoping, stakeholder coordination, and completion with limited oversight.
• Conduct security and compliance reviews of third parties by analyzing documentation such as security questionnaires, architecture details, attestations, policies, and contracts.
• Evaluate vendor security posture against requirements for confidentiality, integrity, availability, privacy, access control, incident response, change management, and regulatory obligations.
• Partner with Procurement, Legal, Security Engineering, IT, and business owners to validate use cases and ensure risks are understood.
• Document identified gaps, assumptions, compensating controls, and recommended next steps.
• Maintain execution against vendor review SLAs and recurring obligations, escalating higher-risk issues.

Security Training

• Own end-to-end delivery of moderately complex security training program workstreams including planning, content coordination, rollout tracking, and continuous improvement with limited oversight.
• Support the design, maintenance, and execution of security and compliance training, with focus on role-based, environment-specific, and regulatory obligations.
• Maintain training content to align with policies, practices, and requirements such as FedRAMP, CJIS, export control.
• Partner with GRCT, Legal, HR, Security, IT, and stakeholders to validate training materials.
• Coordinate recurring training cycles, onboarding assignments, acknowledgements, re-certifications, and evidence collection for audit readiness.
• Track status, identify gaps, and drive follow-through against program deadlines and obligations.

Requirements

• 5+ years of experience working as an individual contributor with a Governance, Risk, Compliance and Trust team.
• Strong working knowledge of customer trust, compliance operations, risk, and the evidence and control narratives needed to support questionnaires, reviews, and audits.
• Experience supporting FedRAMP, SOC 2, ISO 27001/27017/27018, or similar compliance frameworks.
• Ability to independently drive moderately complex workstreams, navigate ambiguity, communicate clearly with stakeholders, and improve processes.
• High attention to detail, disciplined execution, and commitment to quality, integrity, and cross-functional partnership.