Hybrid GRC Analyst: ISO/SOC Auditor & Policy Builder

FloQast; Chicago (IL); Hybrid; USD 115,000 - 155,000; Full time

Job summary

FloQast is seeking a GRC Analyst to strengthen our Compliance team. You will manage internal controls, policies, and testing procedures to support regulatory and information security needs. You’ll advise across departments, aligning workflows to build a best-in-class compliance program.

The role collaborates with ISO 27001/27701/42001 and SOC audits, drafting policy updates, and maintaining risk-aware culture. Hybrid in-office schedule applies, with ongoing review of office requirements.

Qualifications

• 3–5+ years of relevant experience.
• Knowledge and familiarity with security, privacy and compliance practices (SOC 1, SOC 2, ISO 27001, ISO 27701, ISO 42001, PCI, HIPAA).
• Understanding of information security and privacy fundamentals.
• Certifications preferred: CompTIA, CISSP, CISA, CISM, Cloud platforms such as AWS, Azure or GCP.
• Confidence and willingness to raise issues and concerns promptly.
• Understanding of AI governance or leveraging AI tools to improve compliance and audit efficiency.

Responsibilities

• Manage FloQast's internal controls inventory and update as new controls are added.
• Document control owners, testing procedures, and related policies; keep information up to date.
• Ensure process narratives are documented and updated annually for all controls.
• Initiate, monitor, and follow up on monthly and quarterly control activities with proper evidence for audits.
• Advocate for security and compliance across teams to foster a risk-aware culture.
• Draft and update policies, standards, processes, and guidelines with approvals.
• Support ISO 27001, ISO 27701, ISO 42001, SOC 1, SOC 2 audits with evidence requests and follow ups.
• Aggregate identified internal control issues and perform root cause analysis with remediation.
• Be the point of contact for stakeholders on compliance best practices.
• Support customer assurance activities, including security questionnaires.
• Participate in cross-functional project teams and other tasks as needed.

Skills

GRC experience

Security fundamentals

Privacy knowledge

AI governance familiarity

Tools

CompTIA

CISSP

CISA

CISM

AWS

Azure

GCP

Job description

FloQast is seeking a GRC Analyst to strengthen our Compliance team. You will manage internal controls, policies, and testing procedures to support regulatory and information security needs. You’ll advise across departments, aligning workflows to build a best-in-class compliance program.

The role collaborates with ISO 27001/27701/42001 and SOC audits, drafting policy updates, and maintaining risk-aware culture. Hybrid in-office schedule applies, with ongoing review of office requirements.