Senior Security GRC Analyst

Responsibilities

• Own and mature the security compliance framework, including continuous controls monitoring, security awareness training, evidence currency, audit coordination, auditor communications, and remediation tracking.
• Automate GRC workflows for evidence collection, questionnaire responses, risk management, and compliance enforcement using compliance platforms and AI tooling.
• Own the third-party risk management program, including vendor security assessments, risk tiering, approval workflows, and continuous monitoring.
• Develop and maintain the risk management program, including the risk register, risk assessments, treatment tracking, and leadership reporting.
• Write, maintain, and update security policies, standards, procedures, and related documentation.
• Own customer security assurance, including security questionnaires, evidence requests, trust center content, and knowledge base materials.

Requirements

• 3–5 years of experience operating and scaling security GRC, compliance, or customer assurance programs in high-growth environments, specifically security GRC.
• Hands-on knowledge of security controls involving IAM, endpoint security, and cloud infrastructure.
• Strong attention to detail and ability to review sensitive, content-heavy documentation.
• Strong cross-functional coordination across People, Legal, IT, Operations, Engineering, and leadership.
• Experience writing, maintaining, and updating security policies, standards, and procedures.
• Experience with SOC 2 or equivalent frameworks and customer assurance, including security questionnaires, evidence requests, and RFPs.
• Experience with compliance platforms and continuous controls monitoring, such as Vanta, Drata, Oneleet, or SafeBase.
• Experience using AI tools such as Claude or ChatGPT for GRC workflows.
• Strong written communication for customer-facing security responses and audit documentation.

Nice-to-haves

• Incident response or security operations experience.
• Auditor experience, including Big Four or security audit firms, or experience serving as an internal audit lead.
• Experience developing agents or tools for GRC workflows.
• Experience supporting security reviews of contract redlines and legal contracts.
• Fintech or financial services experience.
• CISSP, CISA, CRISC, or equivalent certification.

Compensation and Benefits

• Salary range: $180,000–$215,000 annually, plus equity compensation.
• Fully remote work.
• Workspace setup stipend.
• Competitive benefits based on employee location, including medical, dental, vision, and 401(k) benefits in the United States.
• Unlimited paid time off.
• Monthly three-day weekend.