GRC Analyst (Compliance Operations)

Outsourced; Colombia; Remote; COP 60,000,000 - 120,000,000; Full time

Benefits offered by this job

Fully remote

Professional development

Exposure to major compliance Framework

Job summary

Outsourced is seeking an experienced GRC Analyst to support U.S.-based startups and technology companies from a fully remote Colombia-based team. You will manage day-to-day compliance operations across multiple client accounts, ensuring controls are implemented and evidence is audit-ready.

You will work with SOC 2, ISO 27001, and other frameworks, configure GRC platforms, conduct risk assessments, and coordinate audits with U.S.-based professionals. Strong attention to detail is essential.

Qualifications

• 2–4 years in GRC, IT audit, cybersecurity compliance or security operations.
• Experience managing multiple clients or compliance engagements simultaneously.
• Working knowledge of SOC 2, ISO 27001, HIPAA, NIST 800-53, GDPR or related frameworks.
• Hands-on with at least one GRC platform (Drata, Vanta, Secureframe, Thoropass, Sprinto).
• Strong written English and ability to interact with U.S.-based clients.

Responsibilities

• Manage daily compliance operations across multiple client accounts.
• Monitor GRC platforms for control status, evidence and tests.
• Identify and remediate failing controls; track through resolution.
• Collect and maintain audit-ready evidence for SOC 2, ISO 27001, and others.
• Support SOC 2 Type I/II and ISO 27001 assessments and related activities.
• Conduct user access reviews and third-party security evaluations.
• Configure GRC platforms and support security control implementations.
• Respond to client questions via Slack with clear guidance.
• Assist with DDQs and vendor assessments as required.
• Track tasks and requests using Linear or similar tools.

Skills

GRC operations

SOC 2 readiness

ISO 27001

Regulatory compliance

English communication

Education

Bachelor's degree in CS/IS

Tools

Drata

Vanta

Secureframe

Thoropass

Sprinto

Job description

• Complete security questionnaires, due diligence questionnaires (DDQs), and vendor assessments.

About the Role

We are looking for an experienced GRC Analyst to join a growing cybersecurity and compliance team supporting U.S.-based startups and technology companies.

In this hands-on role, you will manage day-to-day compliance operations across multiple client accounts, ensuring security controls are properly implemented, evidence is audit-ready, and compliance requirements are met.

You will work with different regulatory and security frameworks, GRC platforms, and client environments, collaborating with U.S.-based security and compliance professionals.

This opportunity is ideal for someone with strong GRC knowledge, excellent attention to detail, and experience managing multiple clients or compliance engagements simultaneously.

Key Responsibilities

• Manage daily compliance operations across multiple client accounts.
• Monitor GRC platforms, including control status, evidence freshness, failing tests, and integrations.
• Identify and remediate failing controls, ensuring issues are tracked through resolution.
• Collect, organize, and maintain audit-ready evidence for SOC 2, ISO 27001, and other compliance frameworks.
• Support SOC 2 Type I and Type II audits, ISO 27001 assessments, and related compliance activities.
• Conduct user access reviews, vendor risk assessments, and third-party security evaluations.
• Perform initial gap assessments and develop prioritized remediation plans for new clients.
• Configure GRC platforms and support the implementation of security controls.
• Respond to client compliance questions through Slack, providing clear and accurate guidance.
• Complete security questionnaires, due diligence questionnaires (DDQs), and vendor assessments.
• Support user provisioning and deprovisioning processes across platforms such as Okta, Google Workspace, Slack, and Jamf.
• Track tasks, remediation activities, and client requests using Linear or similar project management tools.
• Provide regular progress updates to engagement leads and elevate critical issues when necessary.

Requirements

• 2-4 years of hands-on experience in GRC, IT audit, cybersecurity compliance, or security operations.
• Proven experience managing multiple clients or compliance engagements simultaneously. This is a mandatory requirement.
• Working knowledge of at least two of the following frameworks:
• SOC 2
• ISO 27001
• HIPAA
• NIST 800-53
• CMMC
• PCI DSS
• GDPR
• Hands-on experience with at least one GRC platform, such as Drata, Vanta, Secureframe, Thoropass, or Sprinto.
• Strong written English communication skills, with the ability to communicate professionally with U.S.-based clients.
• Ability to work with substantial overlap with U.S. business hours, primarily Eastern Time.
• Strong organizational skills and attention to detail.
• Ability to work independently, manage competing priorities, and meet deadlines.

Nice to Have

• Experience working at an audit firm performing SOC 2 or ISO 27001 readiness assessments or control testing.
• Experience with GRC platform implementation or professional services.
• Background working at an MSP, MSSP, or consulting firm supporting multiple clients.
• Familiarity with cloud environments such as AWS, GCP, or Azure.
• Experience with identity management platforms such as Okta, Google Workspace, or Microsoft Entra ID.
• Familiarity with MDM solutions such as Jamf or Intune.
• Experience using Linear, Jira, or similar project management tools.
• Relevant certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer.

Working Conditions

• Location: Fully Remote.
• Employment Type: Full-Time, Dedicated.
• Schedule: U.S. business hours, primarily Eastern Time.
• Team: Work directly with U.S.-based cybersecurity and compliance professionals.
• Engagement: Dedicated position supporting a portfolio of client accounts.

What We Offer

• Full-time employment with benefits and paid time off under applicable local labor regulations.
• Fully remote work environment.
• Direct exposure to major cybersecurity and compliance frameworks.
• Opportunities to work with leading GRC platforms and security technologies.
• Access to AI-powered tools and workflows.
• Mentorship and professional development opportunities.
• The opportunity to grow alongside an expanding cybersecurity and compliance team.

Important Information

• This is a full-time position and must be your primary professional commitment.
• Candidates must be comfortable working with sensitive client information and completing identity, background, and reference checks.
• A practical assessment will be part of the selection process.