Security Compliance Analyst, GRC

Job Description:

• Support and maintain security and compliance programs aligned with frameworks such as NIST, ISO, PCI DSS, and HIPAA
• Assist in maintaining alignment with global privacy regulations (GDPR, CCPA, and similar frameworks)
• Assist in the development, implementation, and maintenance of security, privacy, and AI governance policies, standards, and procedures
• Coordinate and support internal and external audits (e.g., SOX, PCI DSS, SOC 2, ISO, HIPAA)
• Track and manage remediation efforts for identified risks, control gaps, and audit findings
• Support third-party risk management processes, including vendor assessments for AI/ML and data processing providers
• Partner with engineering, data, and AI/ML teams to ensure secure and compliant system and model lifecycle practices
• Maintain and improve GRC tooling (e.g., AuditBoard, Vanta, or similar platforms)
• Monitor regulatory and framework changes (U.S. and international), including emerging AI governance requirements
• Develop and maintain risk registers, control matrices, and compliance documentation
• Conduct risk assessments, including technology, security, privacy, and AI/ML model risk evaluations
• Assist with security, privacy, and responsible AI awareness and training initiatives
• Provide reporting and metrics on risk posture, compliance status, and AI governance maturity

Requirements:

• Bachelor’s degree in Cybersecurity, Information Security, Information Technology/Systems, or related field
• 3–5 years of experience in GRC, security compliance, risk management, audit, or related field
• Experience supporting audits and compliance assessments
• Experience with third-party/vendor risk management
• Familiarity with data governance principles (classification, retention, lineage)
• Thorough understanding of risk management methodologies and control frameworks
• Strong communication, documentation, organizational, and analytical skills
• Ability to communicate security, privacy, and AI risk concepts to technical and non-technical stakeholders
• Working knowledge of core frameworks: NIST CSF, PCI DSS, HIPAA, ISO 27001/27002, and global privacy regulations (GDPR, CCPA)
• Foundational understanding of AI/ML systems and associated governance, risk, and compliance considerations (NIST AI RMF, ISO 42001)
• Familiarity with cloud environments (AWS primary, Google Workspace/MS Azure preferred) and modern SaaS architectures
• Experience with GRC tools (AuditBoard, Vanta, Drata, Archer, ServiceNow GRC, or similar) and ticketing/workflow/documentation tools (Jira, Freshservice, Confluence, GitHub, etc.)

Benefits:

• Competitive salary & equity compensation for full-time roles
• Unlimited PTO, company holidays, and quarterly mental health days
• Comprehensive health benefits including medical, dental & vision, and parental leave
• Employee Stock Purchase Program (ESPP)
• 401k benefits with employer matching contribution
• Offsite team retreats

Apply tot his job Apply To this Job