GRC Security Analyst: Automate Compliance & Risk

Discord

San Francisco (CA)

Hybrid

USD 144,000 - 162,000

Full time

14 days+

Get more replies from employers

Send a job-specific resume in minutes.

Benefits offered by this job

Equity

Relocation assistance

Job summary

Discord is seeking a Security Analyst to lead and scale its Security GRC program. You will own the day-to-day workflows—from questionnaires to risk tracking—partnering with Security, Engineering, IT, and Legal to make compliance friction-free.

The role emphasizes automation, documentation, and repeatable processes to reduce manual work and improve controls across the org. The ideal candidate has 4+ years in security compliance or related fields, hands-on experience with GRC processes, and a

Qualifications

4+ years in security compliance, GRC, or a closely related field (security operations, IT risk, audit).
Working familiarity with common frameworks (ISO 27001/27002, SOC 2, PCI DSS, GDPR/CPRA) and a sense of how their requirements turn into day-to-day controls.
Hands-on experience operating compliance processes: evidence collection, control tracking, risk register upkeep, or security questionnaire response.
An automation-first instinct. You reach for tooling, integrations, and repeatable workflows to replace manual, repetitive compliance work, not box-checking.
Comfort living across tools (GRC platforms, ticketing, docs and wikis) and a habit of keeping data clean and organized.
Clear writing, with a knack for turning dense requirements into guidance people actually use.
Ability to work across teams and influence without authority in a fast-moving environment with competing priorities.

Responsibilities

Run the customer security questionnaire program end-to-end, from intake through response, and grow a reusable answer library that turns repeat questions into fast, near-self-service answers.
Operate risk and control workflows: triage incoming risks, track gap closure and risk treatment through to completion, and keep the risk register accurate and current.
Run GRC analyses that turn into decisions: how standards, procedures, and controls align to our policies and framework requirements; where the gaps are; and how mature and effective our controls actually are.
Build and maintain the GRC toolchain and its automation: administer our GRC platform, ticketing, and knowledge bases, and design the integrations and workflows that collect evidence and check controls by default rather than by hand.
Create the documentation that makes the program usable: internal guidance and updates to our policies, standards, and procedures; company-wide GRC communications; and security training delivered in plain language that people outside the field can follow.