Senior GRC Analyst - Central or Eastern time, US or Canada

Shift Technology; Toronto; Hybrid; CAD 167,000 - 209,000; Full time

Benefits offered by this job

Flexible remote and hybrid options

Performance-based bonus

Learning & development opportunities

Generous PTO & holidays

MAD Days (volunteering)

Job summary

Shift Technology seeks a Senior GRC Analyst to lead governance, risk, and compliance across our security program. Based in the Central or Eastern US/Canada time zones, you will develop policies, manage audits, and coordinate privacy and third‑party risk activities.

You will collaborate with engineering and product teams, guide DPIAs, ensure ISO27001/SOC2 compliance, and support customer due diligence. This role reports to the GRC Lead and offers hybrid work, growth, and cross‑border exposure.

Qualifications

• 7+ years of proven experience in a GRC, IT Audit, Security Assurance, or Information Security role.
• Bachelor's Degree in a relevant field or equivalent work experience.
• Professional certifications such as CIPP/E, CIPP/US, CIPT CISA, CISM, CRISC, or CISSP are highly desirable.

Responsibilities

• Governance & Policy Management: translate security expectations into policies, standards, and procedures.
• Risk Management & Security Assurance: maintain the security assurance plan and assess third-party security.
• Compliance & Audits: manage audits for certifications like ISO 27001 and SOC 2 Type II.
• Third-Party Risk Management: conduct risk assessments with suppliers.

Skills

GRC

IT Audit

Security Assurance

Information Security

Education

Bachelor's Degree in a relevant field

Tools

Drata

Job description

Senior GRC Analyst - Central or Eastern time, US or Canada

Shift delivers AI agents that transform insurers' most critical work. By combining deep industry expertise and unmatched data resources, Shift provides proven results that have earned the trust of hundreds of the world's leading insurers. Our insurance-grade AI is accurate, explainable, and secure - empowering human experts to move with unmatched speed, total confidence, and a renewed focus on the people they serve.

Our culture is built on innovation, trust, and a drive to transform the insurance industry through our SaaS platform. We come from more than 50 different countries and cultures and together we are creating the future of insurance.

As a Senior GRC Analyst, you will be a cornerstone of Shift's security program, responsible for developing, maintaining, and assessing our integrated security and privacy management framework. You will manage our compliance with key industry standards, lead risk assessments, oversee our third-party security assurance program, and support TrustOps efforts for customer collateral, questions, contract reviews, and due diligence. This role is critical for ensuring that Shift meets its regulatory obligations and maintains the trust of our customers. As part of the Information Security department, this role reports to the GRC Lead.

RESPONSIBILITIES

Governance & Policy Management

• Act as a lead contact to translate Shift's global information security expectations into actionable policies, standards, and procedures.
• Promote a mind-set of security and compliance across the organization, transferring knowledge of standards and acting as a subject matter expert (SME).
• Contribute to the development and support of the security awareness program to ensure it aligns with policy and compliance requirements.
• Partner with the Data Protection Officer to develop and maintain privacy policies, data handling standards, and public-facing privacy notices in line with privacy laws and global regulations such as GDPR.

Risk Management & Security Assurance

• Develop and maintain the security assurance plan, ensuring key controls are effectively designed and implemented to meet Shift policies and standards.
• Improve the third-party information security assurance and continuous assessment process.
• Identify key risk areas in collaboration with engineering and business teams and facilitate security control evaluations and testing.
• Review architectural designs and new initiatives to ensure they align with security policies and effectively mitigate risk.
• Proactively identify potential information security GRC problem areas and execute plans to improve the overall assurance workflow.
• Support and facilitate Data Protection Impact Assessments (DPIAs) for new products and initiatives.

Compliance & Audits

• Manage and coordinate internal and external audits for certifications such as ISO 27001 and SOC 2 Type II.
• Perform analysis and compile documentation and evidence to demonstrate the compliance level of systems, services, and controls.
• Work with internal teams to manage the remediation of audit findings and track them to closure.
• Support legal and stakeholder teams in responding to Data Subject Access Requests (DSARs)

Third-Party Risk Management

• Develop, execute, and improve the third-party information security assurance and continuous assessment process.
• Communicate with third parties and suppliers to conduct risk assessments, review their security posture, and manage the remediation of identified issues.

SKILLS & BACKGROUND

Experience & Education

• 7+ years of proven experience in a GRC, IT Audit, Security Assurance, or Information Security role.
• Bachelor's Degree in a relevant field or equivalent work experience.
• Professional certifications such as CIPP/E, CIPP/US, CIPT CISA, CISM, CRISC, or CISSP are highly desirable.
• Direct experience of delivery in highly regulated industries, i.e financial services, healthcare.
• Direct experience managing or supporting formal audit and certification processes from start to finish.

Knowledge & Frameworks

• Deep knowledge of security and privacy frameworks is required (e.g., ISO 27001, ISO27701, SOC 2 Type II, HITRUST, NIST CSF)
• Strong knowledge of global privacy and healthcare regulations (e.g., GDPR, HIPAA)
• Working knowledge of AI regulations, frameworks, and standards (e.g., EU AI Act, ISO 42001)
• Working knowledge of business continuity, disaster recovery, and incident response planning, including plan structure, exercise and test methodologies.
• Hands-on experience with modern GRC management tools, preferably Drata - connecting integrations, tuning automated evidence collection and monitoring tests, and building custom controls and frameworks.

Core Competencies

• Exceptional communication and presentation skills, with the ability to translate complex compliance requirements into clear business guidance.
• Strong stakeholder management skills with the ability to influence and align teams without direct authority.
• Highly organized with strong project management skills, capable of managing multiple audits and assessments simultaneously.
• An analytical mindset with the ability to balance regulatory requirements with business objectives and priorities.

RECRUITMENT PROCESS

• First fit call with our Talent Acquisition Manager
• Team fit call with the Hiring Manager
• Tech round with the Team
• A final interview with our CISO

#LI-RH1 #LI-HYBRID

The range listed is for base compensation. Your actual base salary will vary based on factors including location and individual qualifications objectively assessed during the interview process.

In addition to base salary, your total rewards package will include additional components such as incentive pay and benefits. If you're interviewing for this role, speak with your Talent Acquisition Partner to learn more about the specific details for this position.

Base Salary Pay Range

$120,000 - $150,000 USD

To support our permanent, full time employees at every stage of their careers and lives, we provide a competitive total rewards and benefits package. Here are the global benefits we'd like to highlight:

• Flexible remote and hybrid working options
• Competitive Salary and a variable component tied to personal and company performance
• Multiple Learning and Development opportunities, including Focus Fridays, a half-day each month to focus on learning and personal growth
• Generous PTO and paid holidays
• 2 MAD Days per year (Make A Difference Days for paid volunteering)

Additional benefits may be offered by country, based on your eligibility - ask your recruiter for more information. Intern and Apprentice positions may receive some of these benefits - ask your recruiter for more details.

AI tools are used to help review applications for this role. Read our AI in Recruitment Notice for what the AI considers, how to request a human review, and our most recent bias audit.

At Shift we strive to be a diverse and inclusive workforce. We welcome applications from and hire people who will contribute to the diversity of our company,without regard to race, color, religion, marital status, age, national or ethnic origin, physical or mental disability, medical condition, pregnancy, genetic information, gender identity or expression, sexual orientation, or other non-merit criteria. Shift Technology is committed to providing reasonable accommodations for qualified individuals with disabilities in our application and employment process. Should you require accommodation, please email [e-mail] and we will work with you to meet your accessibility needs.

Interested in building your career at Shift Technology? Get future opportunities sent straight to your email.