GRC Analyst II – Remote, SOC 2 & Compliance

Payscale; United States; On-site; USD 65,000 - 90,000; Full time

Benefits offered by this job

401(k) company match

Comprehensive health benefits

Remote‑first with stipend

Parental leave

Job summary

Payscale is seeking a GRC Analyst II to join our Information Security Team, reporting to the Manager of GRC. In this role, you will take on broader ownership of core GRC program areas while supporting senior-level initiatives across risk, audit, and compliance.

The ideal candidate brings hands-on GRC experience, strong communication skills, and the ability to operate independently across technical and business stakeholders to drive compliance and risk outcomes.

Qualifications

• Hands-on GRC experience across risk, audit and compliance within a commercial SaaS or software company.
• Experience supporting SOC 2, ISO 27001, NIST 800-53 or CIS frameworks.
• Strong ability to communicate with both technical and business stakeholders.

Responsibilities

• Maintain data classification program with tagging standards and data owners.
• Maintain system classification and ownership inventories with defined cadences.
• Support audit coordination for SOC 2 and similar frameworks.
• Conduct vendor security assessments and manage third-party risk workflows.
• Manage policy lifecycle, drafting, reviews and version control.
• Identify control gaps and partner with business units to implement improvements.

Skills

GRC experience

SOC 2 / ISO27001 / NIST 800-53

Data governance

Vendor risk assessments

Education

Bachelor's degree in cybersecurity or related field

Tools

GRC tools (Drata)

ServiceNow GRC

Policy management systems

Job description

Payscale is seeking a GRC Analyst II to join our Information Security Team, reporting to the Manager of GRC. In this role, you will take on broader ownership of core GRC program areas while supporting senior-level initiatives across risk, audit, and compliance.

The ideal candidate brings hands-on GRC experience, strong communication skills, and the ability to operate independently across technical and business stakeholders to drive compliance and risk outcomes.