GRC Analyst (Homebased)

Outsourced; Metro Manila; Remoto; PHP 600.000 - 1.000.000; Tempo pieno

Descrizione del lavoro

Outsourced in the Philippines is seeking a GRC Analyst to manage client compliance programs across platforms. You will handle evidence collection, audits readiness, access reviews, and respond to Slack queries, while tracking work in Linear.

Responsibilities include maintaining GRC platforms (Drata, Vanta, Secureframe, Thoropass, Sprinto), conducting risk assessments, and coordinating with US teams. This role is home-based with night shifts to align with US business hours.

Competenze

• 2-4 years hands-on in GRC, IT audit, compliance, or security operations.
• Direct experience working multiple clients or engagements simultaneously.
• Working knowledge of SOC 2, ISO 27001, HIPAA, NIST 800-53, PCI DSS, GDPR.
• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English, able to respond to clients in Slack and in writing daily.

Mansioni

• Keep client compliance platforms healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
• Run a weekly pass across accounts to catch gaps and stale evidence before audits.
• Triage failing controls, fix what you can, open Linear tickets with owner and SLA, drive to closed.
• Collect audit-ready evidence: screenshots with dates, correct system views, and auditable permissions.
• Prepare and organize evidence packages for SOC 2 Type I/II, ISO 27001, and other audits.
• Run user access reviews end to end: exports, chase owners, document findings and actions, track to sign-off.
• Conduct vendor and third‑party risk assessments: collect SOC 2, DPAs, review data handling and integrations.
• Work new clients through gap assessments: map environment to framework, identify missing items, create remediation plan in Linear.
• Stand up GRC platform for new clients, connect integrations, move first controls.

Conoscenze

GRC experience

Multi-client engagements

English writing

Compliance operations

Strumenti

Drata

Vanta

Secureframe

Thoropass

Sprinto

Descrizione del lavoro

Job Description

As a GRC Analyst you keep compliance programs healthy across a portfolio of client accounts. This is a hands-on, behind-the-scenes role. You live inside GRC platforms and client systems. You close failing controls, collect and organize evidence, run access reviews, work through security questionnaires, and answer the day-to-day compliance questions clients ask in Slack. You track every piece of work in Linear so nothing slips.

Responsibilities

GRC PLATFORM OPERATIONS

• Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
• Run a weekly pass across your accounts to catch gaps, failing controls, and stale evidence before they become audit issues.
• Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.

EVIDENCE, AUDITS, AND REVIEWS

• Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept
• Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.
• Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.
• Conduct vendor and third-party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.

GAP ASSESSMENTS AND ONBOARDING

• Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.
• Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.

COMPLIANCE QUESTIONS IN SLACK

• Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to upscale to the U.S. team
• Keep client Slack channels responsive during business hours.

SECURITY QUESTIONNAIRES

• Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.

IT AND ACCESS OPERATIONS SUPPORT

• Support joiner, mover, and leaver workflows tied to compliance: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.
• Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through

TRACKING AND COORDINATION

• Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.
• Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.

Qualifications

• Two to four years hands-on in GRC, IT audit, compliance, or security operations, ideally in a consulting, MSSP, or multi-client environment.
• Direct experience working multiple clients or engagements at the same time. This is a firm requirement.
• Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English. You will answer clients in Slack and in writing every day.
• Able to work substantial overlap with U.S. business hours.
• Familiarity with cloud (AWS, GCP, Azure) (Nice to have)
• Experience tracking work in Linear, Jira, or a similar system (Nice to have)
• Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)

Additional Information

• Homebased
• T to Sat, 12am to 9am