GRC Analyst

Responsibilities

• Run the day-to-day compliance program end to end across SOC 2 Type II, ISO 27001, NIST 800-53, and FedRAMP Moderate equivalency: continuous evidence collection, control monitoring, and audit readiness held on GRC platforms (Vanta) and the tooling we build in-house.
• Own the policy and procedure set: draft, maintain, and run the review cycle so documentation keeps pace with the controls as the program grows.
• Run recurring control operations on cadence, access reviews, control owner attestations, and evidence refreshes, chasing system owners and employees across the org directly to get them done on time.
• Drive audit and assessment cycles with external auditors and assessors and manage the POA&M to closure, tracking each finding to a named owner and milestone so nothing ages past its deadline.
• Bring each new site and team into the compliance program as we scale, mapping their systems to existing controls so coverage stays consistent instead of fragmenting facility by facility.

Requirements

• Operated controls and pulled evidence against at least one major framework (SOC 2, ISO 27001, NIST 800-53, or FedRAMP) through a real audit.
• Owned a compliance documentation set, policies, procedures, and control narratives, and kept it current as the environment changed.
• Sat across from an auditor or assessor, defended how a control runs in practice, and closed findings.
• Get evidence and adherence out of busy engineers, system owners, and employees across the org, on time, without a manager pushing.
• Catch a stale control, an expired access grant, or a coverage gap before an assessor does, by watching the portfolio continuously.
• Translate a control requirement into the exact artifact that proves it, and keep that mapping tight across overlapping frameworks.

Nice-to-Haves

• FedRAMP Moderate equivalency or NIST 800-53 evidence work.
• GRC platforms (Vanta) or comparable continuous-compliance tooling.
• Cloud, GPU, or data center environments.
• Mapping controls across SOC 2, ISO 27001, and NIST in parallel.