Job Description
As a GRC Analyst you keep compliance programs healthy across a portfolio of client accounts. This is a hands-on, behind-the-scenes role. You live inside GRC platforms and client systems. You close failing controls, collect and organize evidence, run access reviews, work through security questionnaires, and answer the day-to-day compliance questions clients ask in Slack. You track every piece of work in Linear so nothing slips.
Responsibilities - GRC PLATFORM OPERATIONS
- Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
- Run a weekly pass across your accounts to catch gaps, failing controls, and stale evidence before they become audit issues.
- Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.
- EVIDENCE, AUDITS, AND REVIEWS
- Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept
- Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.
- Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.
- Conduct vendor and third-party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.
- GAP ASSESSMENTS AND ONBOARDING
- Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.
- Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.
- COMPLIANCE QUESTIONS IN SLACK
- Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to escalate to the U.S. team
- Keep client Slack channels responsive during business hours.
- SECURITY QUESTIONNAIRES
- Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.
- IT AND ACCESS OPERATIONS SUPPORT
- Support joiner, mover, and leaver workflows tied to compliance: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.
- Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through
- TRACKING AND COORDINATION
- Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.
- Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.
Qualifications
- Two to four years hands-on in GRC, IT audit, compliance, or security operations, ideally in a consulting, MSSP, or multi-client environment.
- Direct experience working multiple clients or engagements at the same time. This is a firm requirement.
- Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
- Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
- Strong written English. You will answer clients in Slack and in writing every day.
- Able to work substantial overlap with U.S. business hours.
- Familiarity with cloud (AWS, GCP, Azure) (Nice to have)
- Experience tracking work in Linear, Jira, or a similar system (Nice to have)
- Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)
Additional Information
- Homebased
- T to Sat, 12am to 9am
