GRC Analyst | AI Security & Compliance

Zip; San Francisco (CA); On-site; USD 95,000 - 150,000; Full time

Benefits offered by this job

Start-up equity

Health, vision & dental coverage

Catered meals

Flexible PTO

401k plan

Unlimited AI token usage

Commuter benefits

Home office stipend

Job summary

Zip is hiring a GRC Analyst to drive compliance programs across SOC 1, SOC 2, ISO 27001, and expanding into the EU and regulated industries. You’ll partner with internal teams and external auditors to maintain certifications and enable secure product development.

In this fast-growing environment, you’ll lead risk assessments, support due diligence questionnaires, and translate regulatory requirements into practical controls for cloud-based systems.

Qualifications

• Bachelor's degree required in a related field.
• 2+ years in GRC, information security, audits, or similar roles.
• Strong written and verbal communication with technical and non-technical stakeholders.
• Familiarity with SOC 1, SOC 2, ISO 27001, PCI DSS, WCAG, and FedRAMP frameworks.

Responsibilities

• Drive and perform periodic compliance activities such as access reviews and internal audits.
• Lead responses for customers’ security and governance questionnaires.
• Guide owners to understand requirements and operationalize controls.
• Collaborate with auditors to support third-party audits (SOC 1/2, ISO 27001).
• Develop and maintain security policies and guidelines to meet regulatory requirements.

Skills

GRC experience

Information security

Audits

Stakeholder comms

Education

Bachelor’s degree in a related field

Tools

SOC 1

SOC 2

ISO 27001

ISO 42001

PCI DSS

WCAG

FedRAMP

Job description

Zip is hiring a GRC Analyst to drive compliance programs across SOC 1, SOC 2, ISO 27001, and expanding into the EU and regulated industries. You’ll partner with internal teams and external auditors to maintain certifications and enable secure product development.

In this fast-growing environment, you’ll lead risk assessments, support due diligence questionnaires, and translate regulatory requirements into practical controls for cloud-based systems.