GRC Security Analyst: Compliance, Risk & Controls Lead

Virtru; United States; Hybrid; USD 130,000 - 170,000; Full time

Benefits offered by this job

Flexible PTO

Learning stipend

Team events

EAP (Employee Assistance)

Headspace access

401K + stock options

Medical, dental, vision

Job summary

Virtru is seeking a Security Governance, Risk & Compliance (GRC) Analyst to own and advance our compliance program across FedRAMP, SOC 2, PCI, and HIPAA frameworks. You will lead risk assessments, develop remediation roadmaps, and support regulatory audits while working with cloud tools like Kubernetes, GCP, AWS, Terraform.

Collaboration and independent ownership are expected in an autonomous agile team. You will collaborate with stakeholders, design automated evidence collection, and ensure

Qualifications

• 5+ years information security / IT risk management / IT audit experience.
• Knowledge of governance frameworks: NIST 800-53/800-171, FedRAMP, SOC 2, PCI.
• Cloud security and SaaS controls experience; strong cloud proficiency.

Responsibilities

• Manage and implement complex controls frameworks for Cloud and SaaS.
• Design automation for evidence collection across cloud, endpoints, and SaaS.
• Conduct risk assessments; identify findings and remediation strategies.
• Support incident response activities with risk analysis and remediation.

Skills

InfoSec experience

IT Audit

IT Risk Mgmt

GRC Analyst

Cloud technologies

GRC tools

SIEM tools

Stakeholder comms

Agile teamwork

Conflict resolution

Independent work

Tools

Hyperproof

Vanta

Drata

Job description

Virtru is seeking a Security Governance, Risk & Compliance (GRC) Analyst to own and advance our compliance program across FedRAMP, SOC 2, PCI, and HIPAA frameworks. You will lead risk assessments, develop remediation roadmaps, and support regulatory audits while working with cloud tools like Kubernetes, GCP, AWS, Terraform.

Collaboration and independent ownership are expected in an autonomous agile team. You will collaborate with stakeholders, design automated evidence collection, and ensure