GRC Analyst (Homebased)

Outsourced Quality Assured Services Pty; Philippines; Remote; PHP 600,000 - 900,000; Full time

Benefits offered by this job

Homebased

Job summary

Outsourced Quality Assured Services Pty is seeking a GRC Analyst (Homebased) to manage client compliance platforms and drive audit readiness across multiple accounts.

You will work hands-on inside GRC platforms, close failing controls, collect evidence for SOC 2, ISO 27001, and other audits, and coordinate with U.S. engagement leads. This role requires overlap with U.S. business hours and strong written English.

Qualifications

• Two to four years hands-on in GRC, IT audit, compliance, or security operations.
• Direct experience working multiple clients or engagements at the same time is a firm requirement.
• Experience with at least two: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
• Hands-on experience with a GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English; daily Slack/writing communication.

Responsibilities

• GRC PLATFORM OPERATIONS: Maintain healthy client platforms, track control status and evidence.
• EVIDENCE, AUDITS, AND REVIEWS: Prepare evidence for SOC 2, ISO 27001 and others; run access reviews.
• GAP ASSESSMENTS AND ONBOARDING: Guide new clients through initial gap assessments and platform setup.
• COMPLIANCE QUESTIONS IN SLACK: Provide clear, correct answers to client questions during business hours.
• SECURITY QUESTIONNAIRES: Complete inbound questionnaires and vendor assessments within standard turnarounds.
• IT AND ACCESS OPERATIONS SUPPORT: Manage joiner/mover/leaver workflows across Okta, Google Workspace, Slack, Jamf.
• TRACKING AND COORDINATION: Use Linear for all client requests and provide weekly status updates.

Skills

GRC concepts

IT audit

Security operations

Slack comms

Tools

Drata

Vanta

Secureframe

Thoropass

Sprinto

Job description

Home > Jobs > GRC Analyst (Homebased) Back to all vacancies

GRC Analyst (Homebased)

Full Time Employee

Job Summary

Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and bro

Job Description

As a GRC Analyst you keep compliance programs healthy across a portfolio of client accounts. This is a hands-on, behind-the-scenes role. You live inside GRC platforms and client systems. You close failing controls, collect and organize evidence, run access reviews, work through security questionnaires, and answer the day-to-day compliance questions clients ask in Slack. You track every piece of work in Linear so nothing slips.

Responsibilities:

• GRC PLATFORM OPERATIONS
  • Keep client compliance platforms (Drata, Vanta, Secureframe, Thoropass) healthy day to day: control status, evidence freshness, failing tests, and broken integrations.
  • Run a weekly pass across your accounts to catch gaps, failing controls, and stale evidence before they become audit issues.
  • Triage every failing control. Fix what you can directly. Open a Linear ticket with a clear owner and SLA for the rest, and drive each one to closed.
• EVIDENCE, AUDITS, AND REVIEWS
  • Collect audit-ready evidence: screenshots with visible dates, the correct system views, and permissions shown the way an auditor will accept
  • Prepare and organize evidence packages for SOC 2 Type I and Type II, ISO 27001, and other audits, and keep them ready through the audit window.
  • Run user access reviews end to end: request exports, chase the system owners, document findings and recommended actions, and track every item to sign-off.
  • Conduct vendor and third-party risk assessments: collect SOC 2 reports and DPAs, review data handling and integrations, and document the risk decision.
• GAP ASSESSMENTS AND ONBOARDING
  • Work new clients through their initial gap assessment: map their environment to the framework, identify what is missing, and turn it into a prioritized remediation plan in Linear.
  • Stand up the GRC platform for new clients, connect integrations, and get the first controls moving.
• COMPLIANCE QUESTIONS IN SLACK
  • Answer the questions clients ask every day: do we need a pen test for this, is MFA required here, does this vendor need a review, what does our policy say about X. Give clear, correct, grounded answers, and know when to escape to the U.S. team
  • Keep client Slack channels responsive during business hours.
• SECURITY QUESTIONNAIRES
  • Complete inbound security questionnaires, DDQs, and vendor assessments accurately and on time. Standard turnarounds are one to two days; complex ones five to seven.
• IT AND ACCESS OPERATIONS SUPPORT
  • Support joiner, mover, and leaver workflows tied to compliance: provisioning and deprovisioning across Okta, Google Workspace, Slack, Jamf, and similar, with each step documented.
  • Track that access changes and remediation SLAs are met (Critical 24 hours, High 72 hours, Medium one week) and that nothing falls through.
• TRACKING AND COORDINATION
  • Track all of your work in Linear. Every client ask becomes a ticket with an owner. Slack is for conversation; Linear is the system of record.
  • Give the U.S. engagement leads a clear weekly picture of what is done, what is in progress, and what needs escalation.

Qualifications:

• Two to four years hands-on in GRC, IT audit, compliance, or security operations, ideally in a consulting, MSSP, or multi-client environment.
• Direct experience working multiple clients or engagements at the same time. This is a firm requirement.
• Working knowledge of at least two of: SOC 2, ISO 27001, HIPAA, NIST 800-53, CMMC, PCI DSS, GDPR.
• Hands-on experience with at least one GRC platform: Drata, Vanta, Secureframe, Thoropass, Sprinto, or similar.
• Strong written English. You will answer clients in Slack and in writing every day.
• Able to work substantial overlap with U.S. business hours.
• Familiarity with cloud (AWS, GCP, Azure) (Nice to have)
• Experience tracking work in Linear, Jira, or a similar system (Nice to have)
• Certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer (Nice to have)

Additional Information:

• Homebased
• T to Sat, 12am to 9am