GRC Analyst
Inactive
Y
YipitDataSecurity compliance
This role may be performed fully remotely within the United States., Work hours are flexible, but most employees work East Coast hours.Full-Time
This job is no longer active. We keep the page for reference, but the employer may not accept new applications.
Open jobs in this role
Job Details
Requirements
- Have experience in security, compliance, risk, audit, privacy, vendor risk, or another related field.
- Have hands-on SOC 2 experience, including supporting Type I or Type II audits.
- Be able to test controls, validate evidence, coordinate with auditors, and track remediation through completion.
- Be familiar with SOC 2, NIST CSF, or similar security and compliance frameworks.
- Be able to connect policy or framework requirements to real-world practices in teams and systems.
- Write clearly and translate complicated requirements for people unfamiliar with security frameworks.
- Notice inconsistencies, missing information, and answers that do not add up.
- Organize multiple workstreams, meet deadlines, and follow through.
- Communicate with technical and non-technical teams and explain why requirements matter.
- Use good judgment, take ownership, and know when to work independently or escalate.
Responsibilities
- Drive GRC workstreams from initial request through evidence collection, testing, remediation, and completion.
- Keep the company audit-ready throughout the year.
- Test security controls and assess whether they are working.
- Conduct risk assessments, identify gaps, and help teams develop remediation plans.
- Map controls across SOC 2 and other frameworks.
- Coordinate access reviews, control testing, policy reviews, risk updates, and audit evidence requests.
- Review vendors’ security practices and support customer security questionnaires.
- Draft and maintain policies, standards, control narratives, risk records, metrics, and program documentation.
- Track findings and remediation commitments, follow up with owners, and keep issues moving toward resolution.
- Simplify and automate repetitive GRC work and help develop governance for AI products, agents, and new ways of handling data.
