Senior GRC Analyst

Everyone deserves to work in a safe and secure environment. That's why we're passionate about delivering secure, remote workforce products and services that prioritize the protection of business assets, customer data, and employee information. We're committed to creating products that are not only secure but also user-friendly and accessible to all. 
We thoughtfully infuse AI into our tools, leveraging it as a powerful resource to deliver genuine, practical value and address real security challenges. Join us and help create a future where security meets simplicity and AI-powered innovation.    

The Compliance Analyst sits within the Security Governance, Risk, and Compliance (GRC) team, reporting to the Director of GRC in the CISO org. You'll own audit coordination, control testing, and risk assessment work while actively improving how assurance gets done through technology and automation.

• Coordinating audits across ISO 27001, SOC 2, PCI DSS, HIPAA, NIS2, SOX, and C5, including managing auditor relationships, driving evidence collection, and tracking remediation activities to completion.
• Performing control assessments and testing across technical and administrative domains, partnering with engineering and security teams to evaluate control design and effectiveness.
• Collaborating with Engineering, Security, IT, and Product stakeholders to understand technical architectures and translate them into audit-ready control narratives.
• Leveraging AI tools, automation, and emerging technologies to streamline evidence collection, control testing, and reporting activities.
• Administering and enhancing GRC platforms while developing metrics and dashboards that provide visibility into compliance posture and control effectiveness.

• 4+ years of experience in information security compliance, audit, or risk management within a technology environment.
• Strong understanding of cloud architecture, IAM, infrastructure, and SDLC controls, enabling effective collaboration and communication with technical teams.
• Experience working with one or more compliance frameworks, such as ISO 27001, SOC 2, PCI DSS, HIPAA, NIST 800-53, or NIS2.
• Strong audit communication skills: you know how to manage auditors, push back when evidence requests are out of scope, and defend a control position when you're right.
• Active user of AI tools to improve your own productivity.

• Experience with compliance automation, continuous monitoring initiatives, or GRC platform development.
• Experience with platforms such as Thoropass, AuditBoard, or Drata.
• Experience building AI-driven workflows or automations that reduce compliance toil.
• Experience integrating GRC tooling with engineering, cloud, identity, or monitoring platforms.
• Experience implementing continuous assurance capabilities.