GRC Analyst (Homebased)

Outsourced Quality Assured Services Inc. (ISO Certified); Metro Manila; Remote; PHP 600,000 - 900,000; Full time

Benefits offered by this job

Home-based

Job summary

Outsourced Quality Assured Services Inc. (ISO Certified) seeks a hands-on GRC Analyst to manage client compliance platforms, run audits, and perform vendor risk assessments. You will close failing controls, organize evidence, manage access reviews, and respond to security questions in Slack.

You’ll track work in Linear to ensure nothing slips and coordinate with U.S. engagement leads. The role involves gaps and onboarding, ensuring SOC 2, ISO 27001, and other audits stay on track, with strong

Qualifications

• Two to four years hands-on in GRC, IT audit, compliance, or security operations.
• Direct experience working multiple clients or engagements at the same time.
• Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English.
• Able to work substantial overlap with U.S. business hours.
• Familiarity with cloud (AWS, GCP, Azure) (Nice to have)
• Experience tracking work in Linear, Jira, or a similar system (Nice to have)
• Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)

Responsibilities

• Keep client compliance platforms healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
• Run a weekly pass across accounts to catch gaps, failing controls, and stale evidence before they become audit issues.
• Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.
• Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept.
• Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.
• Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.
• Conduct vendor and third- party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.
• Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.
• Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.
• Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to elevate to the U.S. team
• Keep client Slack channels responsive during business hours.
• Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.
• IT and access operations support: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.
• Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through
• Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.
• Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.

Skills

GRC experience

IT audit

Security operations

SOC 2 knowledge

Cloud familiarity

Tools

Drata

Vanta

Secureframe

Thoropass

Sprinto

Job description

As a GRC Analyst you keep compliance programs healthy across a portfolio of client accounts. This is a hands-on, behind-the-scenes role. You live inside GRC platforms and client systems. You close failing controls, collect and organize evidence, run access reviews, work through security questionnaires, and answer the day-to-day compliance questions clients ask in Slack. You track every piece of work in Linear so nothing slips.

Responsibilities

• GRC PLATFORM OPERATIONS

  • Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and broken integrations.

  • Run a weekly pass across your accounts to catch gaps, failing controls, and stale evidence before they become audit issues.

  • Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.

• EVIDENCE, AUDITS, AND REVIEWS

  • Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept

  • Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.

  • Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.

  • Conduct vendor and third- party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.

• GAP ASSESSMENTS AND ONBOARDING

  • Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.

  • Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.

• COMPLIANCE QUESTIONS IN SLACK

  • Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to elevate to the U.S. team

  • Keep client Slack channels responsive during business hours.

• SECURITY QUESTIONNAIRES

  • Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.

• IT AND ACCESS OPERATIONS SUPPORT

  • Support joiner, mover, and leaver workflows tied to compliance: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.

  • Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through

• TRACKING AND COORDINATION

  • Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.

  • Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.

Qualifications

• Two to four years hands-on in GRC, IT audit, compliance, or security operations, ideally in a consulting, MSSP, or multi-client environment.

• Direct experience working multiple clients or engagements at the same time. This is a firm requirement.

• Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.

• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.

• Strong written English. You will answer clients in Slack and in writing every day.

• Able to work substantial overlap with U.S. business hours.

• Familiarity with cloud (AWS, GCP, Azure) (Nice to have)

• Experience tracking work in Linear, Jira, or a similar system (Nice to have)

• Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)

Additional Information

• Homebased

• T to Sat, 12am to 9am