About This Role
Working as a GRC Analyst, you will manage the daily operations of the company's SOC 2 Type II and GovRAMP programs. This involves collaborating with engineering, IT, and business teams to gather evidence, document controls, and address any identified gaps. The role suits an analyst with strong experience in security compliance and IT audit.
Responsibilities
- Own SOC 2 Type II evidence collection and readiness each audit cycle, from the request list through auditor delivery
- Support GovRAMP assessments for APHS, including evidence packages, the POA&M, and continuous monitoring deliverables
- Draft and maintain security policies and control narratives aligned with SOC 2 and NIST SP 800-53 Rev 5
- Administer Vanta and automate evidence collection to reduce manual work for engineering teams
- Perform risk and third-party assessments, and verify that technical controls in AWS operate as documented
- Coordinate penetration tests, track findings to closure, and own the customer security questionnaire process
- Provide backup coverage for audit and assessment activity as directed
- Assign and follow up on compliance tasks with control owners in other teams
Requirements
- 5+ years of experience in GRC, security compliance, or IT audit
- Ownership of at least one full SOC 2 Type II audit cycle or GovRAMP assessment, from readiness through remediation
- Experience writing security policies and control documentation
- The ability to coordinate deliverables across several teams and keep work moving without close direction
- Familiarity with policy as code, such as defining and testing controls with Open Policy Agent, AWS Config rules, or infrastructure-as-code policy checks
- Clear communication with auditors, engineers, and executives
- The ability to lead, investigate, and coordinate security incidents
Nice to have:
- Experience supporting GovRAMP, StateRAMP, or FedRAMP programs, including POA&M management or continuous monitoring
- A good understanding of cloud security policies
- A certification such as CGRC, CISA, CISSP, CISM, or Security+
- Experience with government or other contract-driven customers
Technical skills we’d like you to have:
- Administration of Vanta, Drata, or a similar compliance platform
- The ability to read AWS configuration evidence and know what good looks like
- Experience automating compliance work with scripts or APIs
Benefits
- Comprehensive health benefits and inclusive wellness support
- Flexible time off and paid holidays
