Governance, Risk, Compliance & Trust Analyst

Everlaw; San Francisco (CA); On-site; USD 140,000 - 178,000; Full time

Benefits offered by this job

Salary range: $140,000 – $178,000 (to

Equity program

401(k) retirement plan with company

Health, dental, and vision

Flexible Spending Accounts

Paid parental leave and sick leave

Vacation days and holidays

Learning and development opportunities

Company‑sponsored life and disability

Job summary

Everlaw seeks a GRCT Analyst to independently drive moderately complex trust, compliance, and risk workstreams. You will translate security and compliance posture into audit-ready and customer-ready outputs, collaborating with Security, Legal, IT, and cross-functional teams to close gaps and maintain governance.

This role spans audit readiness, trust content maintenance, and program improvements. You will manage customer security questionnaires, support SLAs, and contribute to training programs,

Qualifications

• 5+ years of experience in a Governance, Risk, Compliance, and Trust role.
• Experience supporting FedRAMP, SOC 2, ISO 27001/27017/27018 or similar.
• Led completion of customer security questionnaires and trust portals.
• Ability to translate complex topics into clear, written deliverables.

Responsibilities

• Translate Everlaw’s security and compliance posture into audit-ready outputs.
• Support audit readiness across FedRAMP, SOC 2, and ISO frameworks.
• Manage compliance operations including evidence requests and policy updates.
• Partner with Security, Legal, IT, and other stakeholders to produce outputs.
• Maintain trust content across repositories and response libraries.
• Lead vendor review workstreams and security assessments.
• Deliver security training program workstreams and ensure timely completion.

Skills

Governance risk compliance

Audit readiness

Policy maintenance

Customer trust understanding

Tools

GRC tooling

Job description

At Everlaw, our mission is to promote justice by illuminating truth. We build technology that helps legal teams find the information they need to achieve their truth-finding goals.

As a GRCT Analyst, you will independently drive moderately complex trust, compliance, and risk workstreams that help Everlaw scale responsibly and earn customer and regulator trust over time. This role sits at the intersection of customer trust, compliance operations, audit readiness, risk management, documentation quality, and cross‑functional execution.

Key responsibilities include translating Everlaw’s security and compliance posture into clear, accurate, audit‑ready, and customer‑ready outputs while operating with integrity, discipline, and respect for others.

Responsibilities

Compliance

• Support audit readiness across core frameworks such as FedRAMP, SOC 2, and ISO 27001/27017/27018 by organizing evidence, maintaining documentation quality, and partnering with control owners to close gaps.
• Manage compliance operations that require structured follow‑through, including evidence requests, policy and procedure updates, control narrative maintenance, and recurring review cycles.
• Partner cross‑functionally with Security Engineering, DevOps, IT, Legal, People, Procurement, and other stakeholders to gather inputs, validate implementation details, and produce audit‑ready or stakeholder‑ready outputs.
• Help maintain strong execution against defined compliance SLAs, milestones, and recurring obligations, escalating risks early and driving issues through resolution.
• Translate technical, operational, and regulatory topics into clear written deliverables for internal and external audiences.
• Support internal risk and governance processes such as security impact analyses and change‑related compliance reviews.
• Contribute to the ongoing operation of the Public Sector Clearance Program, guiding new cohorts, maintaining status, and communicating updates.

Customer Trust

• Manage customer security questionnaires, trust inquiries, and related diligence requests with minimal supervision.
• Maintain and improve customer‑facing trust content across repositories, portals, knowledge resources, and response libraries.
• Partner closely with Security Engineering, DevOps, Legal, GTM, Product, IT, and other stakeholders to collect inputs, resolve ambiguities, and ensure trust responses are accurate.
• Help maintain strong execution against trust‑related SLAs and operating expectations.
• Identify gaps in trust materials and proactively drive updates.
• Support broader trust enablement initiatives such as trust center improvements and process improvements.
• Use workflow data and request trends to identify recurring concerns and recommend improvements.
• Manage trust inquiry workflows, researching answers, synthesizing evidence, and ensuring timely responses.

Vendor Reviews

• Own end‑to‑end delivery of moderately complex vendor review workstreams.
• Conduct security and compliance reviews of third parties by gathering documentation such as security questionnaires, architecture details, data flow information, attestations, policies, and contractual commitments.
• Evaluate vendor security posture against Everlaw requirements for confidentiality, integrity, availability, privacy, access control, incident response, change management, and regulatory obligations.
• Partner with Procurement, Legal, Security Engineering, IT, and other stakeholders to validate use cases and ensure risks are understood before onboarding or renewal decisions.
• Document gaps, assumptions, compensating controls, and recommended next steps.
• Maintain strong execution against vendor review SLAs and recurring obligations, escalating blockers early.

Security Training

• Own delivery of security training program workstreams, including planning, content coordination, stakeholder alignment, rollout tracking, and continuous improvement.
• Support design and maintenance of security and compliance training required for Everlaw personnel.
• Maintain training content so it is accurate, current, and aligned with Everlaw policies and external requirements.
• Partner with GRCT, Legal, HR, Security, IT, and business stakeholders to gather subject matter input and validate training expectations.
• Coordinate recurring training cycles, onboarding assignments, acknowledgements, re‑certifications, and evidence collection.
• Help maintain strong execution against program deadlines, audit requests, and training obligations.
• Contribute to a training program that reinforces Everlaw principles and promotes disciplined execution.

Qualifications

• 5+ years of experience as an individual contributor in a Governance, Risk, Compliance, and Trust team.
• Strong working knowledge of customer trust, compliance operations, risk, and evidence and control narratives.
• Experience supporting FedRAMP, SOC 2, ISO 27001/27017/27018 or similar compliance frameworks.
• Led completion of customer security questionnaires and experience with trust portals or GRC tooling.
• Experience using workflow, metrics, or dashboard data to improve trust and compliance operations and meet defined SLAs.
• Independently researches complex questions, synthesizes inputs, and produces high‑quality written deliverables.
• Communicates complex topics simply and concisely, tailoring communication to the audience.
• Organized, reliable, and escalates thoughtfully before risks become blockers.
• Considers long‑term impact of decisions on operations, compliance posture, and stakeholder experience.
• Comfortable operating with ambiguity, shifting priorities, and multiple stakeholders.
• Brings sound judgment, professional maturity, and accountability for sensitive or high‑visibility work.

Benefits

• Salary range: $140,000 – $178,000 (subject to change).
• Equity program.
• 401(k) retirement plan with company matching.
• Health, dental, and vision.
• Flexible Spending Accounts for health and dependent care expenses.
• Paid parental leave and approximately 10 days (80 hours) per year of sick leave.
• Seventeen paid vacation days plus 11 federal holidays.
• Membership to Modern Health.
• Annual allocation for learning and development opportunities and professional membership dues.
• Company‑sponsored life and disability insurance.

Perks

• Work in Downtown Oakland near BART line and restaurants.
• Powerful Linux laptop with desk customization.
• Team lunches and out‑of‑the‑box events.
• Free eDiscovery resources through Everlaw for Good.
• Paid volunteer hours (4 per quarter).
• Learning and career development opportunities.
• Ranked #1 on G2 for Ediscovery Software and Momentum.
• Ranked #9 on Glassdoor’s Best Places to Work 2023 for US small and medium companies.
• Ranked #2 on 2022 Bay Area Best Places to Work and #9 on other industry awards.

Equal Opportunity Employer Statement

Everlaw is an equal opportunity employer. We pride ourselves on having a diverse workforce and do not discriminate against any employee or applicant because of race, creed, color, religion, gender, sexual orientation, gender identity or expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law. We respect the gender, gender identity, and gender expression of our applicants and employees, and honor requests for pronouns. We comply with all applicable national, state and local laws pertaining to nondiscrimination and equal opportunity, including the California Equal Pay Act. Pursuant to the San Francisco Fair Chance Ordinance, we consider qualified applicants with arrest and conviction records. We collect and process the personal information you provide along with your job application in accordance with our Applicants Privacy Notice and Notice at Collection.

When preparing to engage with Everlaw as a candidate, you may use AI tools for research, polishing application materials, and interview prep. However, any assessments not explicitly stated, remote interviews or live interviews must be completed independently without AI support. By submitting your application, you agree to adhere to these rules. Here is our full policy; please reach out with any questions.