GRC Analyst - Drive Security, Compliance & Risk Strategy

Whatnot; Los Angeles (CA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Flexible Time off Policy

Health Insurance options

Work From Home Support

Parental Leave

401k matching

Pension plans internationally

Dogfood allowance

Care benefits

Company holidays

Job summary

Whatnot is seeking a Governance, Risk & Compliance Analyst to join our Security GRC team in monitoring and improving the security posture across regulatory and business requirements. You will define and implement controls, collaborate with product and business leaders, and prepare for external audits to maintain trust with regulators and customers.

The role emphasizes strong written communication, cloud-centric audit experience, and the ability to translate complex controls into actionable plans

Qualifications

• 8+ years in security governance, risk and compliance in tech startups.
• Strong knowledge of security standards (ISO 27001, SOC 2, PCI, GDPR/CCPA).
• Experience with large audit firms (Big 4) or similar.

Responsibilities

• Review and implement secure configurations across tools (Okta, Terraform, AWS, Lumos, Cloudflare, Github).
• Develop security requirements for partner teams and drive implementation.
• Prepare for and lead external security audits.
• Shape the strategic direction of the Security GRC team.

Skills

Security governance

Risk management

Compliance

ISO 27001

SOC 2

PCI

GDPR/CCPA

Audit experience

Cloud audits

Written communication

Education

Bachelor’s degree in Computer Science or Information Security

Job description

Whatnot is seeking a Governance, Risk & Compliance Analyst to join our Security GRC team in monitoring and improving the security posture across regulatory and business requirements. You will define and implement controls, collaborate with product and business leaders, and prepare for external audits to maintain trust with regulators and customers.

The role emphasizes strong written communication, cloud-centric audit experience, and the ability to translate complex controls into actionable plans