AI-Driven GRC Analyst — ISO27001 & SOC 2 (Hybrid)

First Roles; San Francisco (CA); Ibrido; USD 134.000 - 202.000; Tempo pieno

Vantaggi offerti da questo lavoro

Equity

Healthcare package

Mentorship & events

Flexible time off

WFH budget

Descrizione del lavoro

Vercel is seeking a Governance, Risk and Compliance (GRC) Analyst to build AI-enabled GRC programs and automate audit evidence. No engineering background is required; you will use AI tooling to automate responses to security questionnaires and assess AI tools and vendors.

This hybrid role is based in San Francisco, New York City, or London with three days in the office weekly. You will manage ISO 27001, SOC 2, HIPAA, and PCI DSS programs and support customer inquiries.

Competenze

• 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment.
• Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third‑party risk review.
• Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners.
• Led compliance projects across multiple business units and seniority levels.

Mansioni

• Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training.
• Maintain the internal controls behind ISO 27001, SOC 2, HIPAA, and PCI DSS compliance, and drive remediation to completion with documented progress.
• Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores.
• Manage annual audit deliverables, write treatment plans, and track completion across teams.
• Answer customer compliance inquiries and maintain customer-facing security and compliance documentation.

Conoscenze

SOC 2

ISO 27001

PCI DSS

HIPAA

Descrizione del lavoro

Vercel is seeking a Governance, Risk and Compliance (GRC) Analyst to build AI-enabled GRC programs and automate audit evidence. No engineering background is required; you will use AI tooling to automate responses to security questionnaires and assess AI tools and vendors.

This hybrid role is based in San Francisco, New York City, or London with three days in the office weekly. You will manage ISO 27001, SOC 2, HIPAA, and PCI DSS programs and support customer inquiries.