GRC Analyst (Homebased)

Outsourced Global Staff; Philippines; Remote; PHP 420,000 - 600,000; Full time

Job summary

Outsourced Global Staff is seeking a GRC Analyst to manage compliance platforms, evidence, and audits from a homebased role in the Philippines. You will fix failing controls, gather audit-ready evidence, and coordinate with client accounts to ensure timely responses and documentation.

You will work with SOC 2/ISO 27001 standards, perform vendor risk assessments, and maintain records in Linear and Slack communications during US business hours.

Qualifications

• 2–4 years hands-on in GRC, IT audit, or security operations.
• Experience handling multiple client engagements simultaneously.
• Knowledge of SOC 2, ISO 27001, HIPAA, NIST 800-53, PCI DSS, or GDPR.
• Hands-on with at least one GRC platform (Drata, Vanta, Secureframe, Thoropass, Sprinto).
• Strong written English; respond in Slack and in writing daily.

Responsibilities

• GRC platform operations across multiple client accounts.
• Collect evidence for audits (SOC 2, ISO 27001) and keep packages ready.
• Run user access reviews and document findings; manage SLAs.
• Answer compliance questions in Slack and coordinate with the US team.
• Complete inbound security questionnaires and vendor assessments.
• Handle joiner/mover/leaver workflows and access provisioning.
• Track work in Linear; provide weekly updates to engagement leads.

Skills

GRC platforms

Strong written English

US hours overlap

Jira/Linear experience

Tools

Drata

Vanta

Secureframe

Thoropass

Sprinto

Job description

GRC Analyst (Homebased) Full Time Employee

Job Summary

Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and bro

Job Description

As a GRC Analyst you keep compliance programs healthy across a portfolio of client accounts. This is a hands-on, behind-the-scenes role. You live inside GRC platforms and client systems. You close failing controls, collect and organize evidence, run access reviews, work through security questionnaires, and answer the day-to-day compliance questions clients ask in Slack. You track every piece of work in Linear so nothing slips.

Responsibilities

• GRC PLATFORM OPERATIONS
  • Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
  • Run a weekly pass across your accounts to catch gaps, failing controls, and stale evidence before they become audit issues.
  • Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.
• EVIDENCE, AUDITS, AND REVIEWS
  • Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept
  • Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.
  • Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.
  • Conduct vendor and third-party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.
• GAP ASSESSMENTS AND ONBOARDING
  • Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.
  • Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.
• COMPLIANCE QUESTIONS IN SLACK
  • Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to elevate to the U.S. team
  • Keep client Slack channels responsive during business hours.
• SECURITY QUESTIONNAIRES
  • Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.
• IT AND ACCESS OPERATIONS SUPPORT
  • Support joiner, mover, and leaver workflows tied to compliance: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.
  • Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through
• TRACKING AND COORDINATION
  • Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.
  • Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.

Qualifications

• Two to four years hands-on in GRC, IT audit, compliance, or security operations, ideally in a consulting, MSSP, or multi-client environment.
• Direct experience working multiple clients or engagements at the same time. This is a firm requirement.
• Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English. You will answer clients in Slack and in writing every day.
• Able to work substantial overlap with U.S. business hours.
• Familiarity with cloud (AWS, GCP, Azure) (Nice to have)
• Experience tracking work in Linear, Jira, or a similar system (Nice to have)
• Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)

Additional Information

• Homebased
• T to Sat, 12am to 9am