Governance, Risk, and Compliance Analyst

YipitData; United States; On-site; USD 80,000 - 110,000; Full time

Benefits offered by this job

Flexible hours

Flexible vacation

401K match

Parental leave

Team events

Wellness budget

Learning reimbursement

Job summary

YipitData seeks a GRC Analyst to drive governance, risk, and compliance work across security, IT, and product teams. You will transform complex requirements into executable actions, support SOC 2 audits, and ensure evidence is thorough and traceable.

The role emphasizes ownership, clear communication with technical and non-technical stakeholders, and ongoing remediation tracking to keep audits ready year-round. Experience in security, risk, and vendor management is valued.

Qualifications

• Hands-on SOC 2 experience, including supporting Type I or Type II audits.
• Familiar with SOC 2, NIST CSF, or similar security frameworks.
• Ability to translate compliance requirements into clear actions for non-GRC teams.
• Strong writing skills to clarify complex requirements.
• Ownership mindset and ability to manage multiple workstreams.
• Experience in security, compliance, risk, audit, privacy, or vendor risk.

Responsibilities

• Support audits, risk assessments, control testing, vendor reviews, and policy reviews.
• Partner with Security, IT, Engineering, Legal, Finance, and People to understand business operations.
• Own GRC workstreams from initial request through evidence collection, testing, remediation, and completion.
• Review vendors and assess their security practices against YipitData’s expectations.
• Translate compliance requirements into actionable tasks for teams outside GRC.
• Draft and maintain policies, standards, control narratives, and risk records.
• Track findings and remediation, ensuring timely closure and evidence quality.
• Identify opportunities to automate repetitive GRC work and scale the program.
• Contribute to governance discussions for AI and emerging technologies.

Skills

SOC 2 experience

NIST CSF familiarity

Security audits support

Evidence validation

Cross-functional communication

Ownership & independence

Remediation tracking

Policy drafting

Job description

• YipitData is looking for a GRC Analyst who likes asking good questions, finding the gaps others miss, and turning complicated requirements into work people can actually complete
• You will help us answer some important questions: Are our security controls working the way we say they are? Can we prove it? Where are we taking on risk? What needs to change as our products, technology, and use of AI continue to grow?
• Your work will span audits, risk assessments, control testing, vendor reviews, customer questionnaires, policies, and compliance programs. You will partner with teams across Security, IT, Engineering, Legal, Finance, and People to understand how the business operates, identify where improvements are needed, and keep the work moving through completion
• This is not a role where success means uploading documents to an audit platform. We want someone who is curious enough to understand the evidence, thoughtful enough to challenge it when it does not make sense, and organized enough to make sure nothing important gets lost in the follow-up
• Take ownership of GRC workstreams and drive them from the initial request through evidence collection, testing, remediation, and completion
• Help keep YipitData audit-ready throughout the year
• Test security controls and determine whether they are actually working, rather than simply confirming that a document exists
• Conduct risk assessments, identify meaningful gaps, and help teams develop remediation plans that are realistic and effective
• Map controls across SOC 2 and other frameworks so one strong control can satisfy multiple requirements
• Coordinate recurring work such as access reviews, control testing, policy reviews, risk updates, and audit evidence requests
• Review vendors and help determine whether their security practices meet YipitData’s expectations
• Support customer security questionnaires by finding the right information, validating it, and making sure our answers are accurate and consistent
• Translate compliance requirements into clear actions for teams that do not live and breathe GRC
• Draft and maintain policies, standards, control narratives, risk records, metrics, and other program documentation
• Track findings and remediation commitments, follow up with owners, and keep issues from quietly sitting open forever
• Look for ways to simplify and automate repetitive GRC work so the program can scale with the business
• Help us think through governance for emerging technologies, including AI products, agents, and new ways of handling data

Benefits

• Flexible work hours
• Flexible vacation
• Generous 401K match
• Parental leave
• Team events
• Wellness budget
• Learning reimbursement

You understand that evidence is only useful if it actually proves the controlYou are a strong writer who can make complicated requirements clear for those not familiar with security frameworksYou are familiar with SOC 2, NIST CSF, or similar security and compliance frameworksYou have hands-on SOC 2 experience, including supporting Type I or Type II audits, testing controls, validating evidence, coordinating with auditors, and tracking remediation through completionYou communicate well with both technical and non-technical teams and can explain why a requirement mattersYou take ownership, use good judgment, and know when to work independently versus when to escapeYou can keep multiple workstreams organized, meet deadlines, and follow throughYou are comfortable asking follow-up questions and respectfully pushing back when something needs a closer lookYou are interested in figuring out how traditional governance needs to evolve for AI and other emerging technologiesYou notice inconsistencies, missing information, and answers that do not quite add upYou can connect a policy or framework requirement to what people and systems are doing in the real worldYou can operate in an environment that is constantly changing: where not every process is perfect or every answer is immediately availableYou have experience in security, compliance, risk, audit, privacy, vendor risk, or another field that taught you how to evaluate whether expectations are being met