GRC Analyst

About This Role

Supporting the company's governance, risk, and compliance program is the core of this role, helping to mature the security posture and expand into new compliance frameworks. This is a hands-on position at the intersection of security, engineering, and business, where you will be the operational engine behind maintaining compliance commitments and earning customer trust.

Responsibilities

• Support the SOC 2 program by driving day-to-day execution of the annual Type II cycle, including evidence collection, control walkthroughs, gap remediation tracking, and auditor support
• Partner on CMMC Level 2 implementation, working alongside an external CMMC consultant and security engineers on System Security Plan (SSP) development, CUI scoping, evidence collection, and C3PAO assessment readiness
• Assess applications and AI tools by conducting security and privacy reviews on new applications, AI/ML services, and other tools before they enter the environment
• Maintain an inventory of AI tools and contribute to AI governance work
• Run vendor and third-party risk intake, owning the vendor security review process, completing questionnaires, and maintaining the vendor risk register
• Maintain policy and procedure, helping to author and maintain the security policy library to stay aligned with SOC 2, CMMC, and how the company operates
• Support the risk register, contributing to formal risk assessments and keeping the enterprise risk register current
• Coordinate audit and assessment logistics, managing evidence requests during audits, scheduling walkthroughs, running quarterly access reviews, and tracking remediation items through closure
• Administer the GRC platform, helping to select and roll out the platform then owning day-to-day administration including integrations, control mapping, and evidence automation
• Drive compliance through Jira by creating, routing, and monitoring security and compliance tickets and partnering with engineering on remediation timelines
• Audit change management hygiene, monitoring engineering Jira queues to ensure tickets meet compliance formatting and content standards, verifying that pull requests are properly linked to Jira tickets, and confirming required notes and documentation are captured for each change
• Support customer trust by responding to customer security questionnaires and helping to maintain trust center content
• Run security awareness, managing the employee security awareness program, including training assignments, phishing simulations, and completion tracking

Requirements

• 3+ years of experience in a GRC, security compliance, IT audit, or closely related role
• Hands-on experience contributing to SOC 2, ISO 27001, HIPAA, or similar compliance program work
• Working knowledge of cloud and SaaS security concepts (AWS, Azure, or GCP, plus the common SaaS stack)