GRC Associate (Contract)

Unit21; United States; Remote; USD 69,000 - 90,000; Part time

Benefits offered by this job

Health insurance

Unlimited PTO

401(k)

Home office setup

Job summary

Unit21 is seeking a part-time GRC Associate to run the day-to-day governance, risk and compliance program. You will own audit evidence, security questionnaire responses, the compliance calendar and vendor reviews, partnering with Security, Sales and Solutions Engineering.

The Head of Security signs off on policy and risk decisions. This role focuses on SOC 2 Type II and PCI DSS, with remote work and an hourly, 6-month term. Hours ~20 per week, US remote, Pacific overlap preferred.

Qualifications

• 2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers.
• Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests.
• Has answered customer security questionnaires or DDQs.
• Clear writing: customer-facing answers should need only light review.
• Organized and persistent; you can track many small asks across teams and follow up without needing escalation.

Responsibilities

• Audit readiness (SOC 2 Type II, PCI DSS).
• Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current.
• Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation.
• Run the biannual and quarterly PCI reviews and track external scan findings to closure.
• Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries.
• Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops.
• Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month).
• Keep the security answers current in the answer library that Solutions Engineering maintains.
• Build a reusable screenshot evidence pack for customers that won't accept Trust Center links.
• Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors.
• Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date.
• Policies, risk and governance: Run the annual review of our security policy set; Manage the security policy exceptions log; Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review; Coordinate the annual BCP/DR test and write the customer-facing summary; Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding.

Skills

GRC experience

Security compliance

IT audit

Compliance automation

Security+

CISA

Tools

Drata

Vanta

Secureframe

OneTrust

Job description

For many people, the most important aspect of a new role is mission alignment. At Unit21, we’re dedicated to fighting financial crime. We’re building out a suite of AI tooling to make detection & investigation so efficient that many vectors of wrongdoing will be eliminated. Our calling card in the industry is customizability and putting control in the hands of Fraud & AML agents to help them work with speed, accuracy, and trust. Unit21 is a place to work for those who want to make a difference.

Job Description

This is a remote position.

About the Role:

We're looking for a part-time GRC Associate to do the day-to-day work of our governance, risk and compliance program. You'll own the deliverables: audit evidence, security questionnaire responses, the compliance calendar, and vendor reviews. You'll partner closely with our security engineers, Sales and Solutions Engineering. The Head of Security owns program strategy, risk decisions and policy sign-off.

What you'll do

Audit readiness (SOC 2 Type II, PCI DSS)

Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current

Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation

Run the biannual and quarterly PCI reviews and track external scan findings to closure

Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries

Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops

Customer trust and sales support

Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month). These include SIG, CAIQ and custom bank questionnaires, often submitted through customer portals such as LogicGate, Aravo and Coupa.

Keep the security answers current in the answer library that Solutions Engineering maintains. New or changed security claims get Security sign-off before they go out.

Build a reusable screenshot evidence pack for customers that won't accept Trust Center links

Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors

Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date

Policies, risk and governance

Run the annual review of our security policy set

Manage the security policy exceptions log

Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review

Coordinate the annual BCP/DR test and write the customer-facing summary

Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding

Third-party risk management

Run security assessments of internal-use and non-critical vendors. Support the Head of Security on critical vendor and subprocessor reviews, including annual reviews.

Keep the subprocessor list accurate and drive customer notifications when it changes

Run the intake and review process for new SaaS apps, OAuth apps, AI tools and MCP servers

Partner compliance and program structure

Handle day-to-day compliance work for our data-provider reseller agreements, starting with LexisNexis: customer credentialing, audit readiness and reporting

Build and run a compliance calendar of recurring controls, reviews, audits and renewals, with named owners

Send a monthly GRC status report to the Head of Security

What you'll bring

Must have

2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers

Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests

Has answered customer security questionnaires or DDQs

Clear writing: customer-facing answers should need only light review

Organized and persistent; you can track many small asks across teams and follow up without needing escalation

Nice to have

Hands-on experience with a compliance automation platform such as Drata, Vanta, Secureframe or OneTrust

ISO 27001 experience

AI governance experience (NIST AI RMF, ISO 42001)

PCI DSS exposure; Security+, CISA or ISO 27001 Implementer

Hours: ~20 hrs/week, flexible within the week. Volume is bursty around audit and questionnaire cycles.

Location: US Remote. Hours in US Pacific time, or a minimum of 4 hours overlap.

Contract: 6-month initial term, renewable, with 30 days' notice to end. Hourly rate.

Onboarding: background check, NDA and security training. Access is through named accounts with least privilege (Drata, Notion, Slack, Google Workspace).

Work Location

This is a remote and hourly position.

Remote work is currently limited to candidates located in the following states:

AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA.

Compensation

Base: $50-$ 65/hour

We Offer

Competitive salary and pre-IPO equity

100% company-paid medical, dental, and vision insurance for employees

Unlimited PTO and generous leave programs

401(k)

Home office setup support

A high-ownership, collaborative culture focused on impact, innovation, and growth

Equal Opportunity Employer

Unit21 is an equal opportunity employer. We encourage candidates to apply even if they don't meet every listed requirement. We are committed to building a diverse, inclusive workforce where everyone has the opportunity to thrive.