Remote GRC Analyst: Cloud Security & Risk

Upwind Security, Inc.; Northern (KY); Hybrid; USD 70,000 - 110,000; Full time

Job summary

Upwind Security, Inc. is seeking a GRC Analyst to join our Security & Compliance team and support SOC 2, ISO 27001, NIST, and FedRAMP. You will manage evidence, remediation tracking, and audits across Engineering, IT, Security, Legal, and HR, translating requirements into actionable tasks for tech and business groups.

You’ll help build scalable, AI-assisted GRC processes. The role requires 3–5 years in GRC, strong writing and documentation skills, and a proactive, cross-functional mindset with a

Qualifications

• 3 to 5 years in GRC, cybersecurity, risk management, compliance, or audit.
• Strong written communication and documentation skills.
• Ability to turn audit findings into remediation plans that teams will actually adopt.

Responsibilities

• Operate and improve Upwind's GRC and security compliance programs.
• Support compliance work across SOC 2, ISO 27001, NIST, and FedRAMP, including control implementation, evidence collection, remediation tracking, continuous monitoring, and audit readiness.
• Coordinate audit and compliance evidence from Engineering, IT, Security, Legal, and HR.
• Translate compliance requirements into clear actions for technical and business teams.
• Perform control assessments, gap analyses, and risk assessments, and recommend remediation.
• Track vulnerabilities, risks, audit findings, and POA&Ms through completion.
• Write and maintain policies, standards, procedures, and control documentation.
• Maintain GRC systems, evidence repositories, and risk registers.
• Research new regulatory and customer requirements and determine how they apply to us.
• Use AI and automation to speed up research, documentation, evidence organization, and workflow, with appropriate validation and data handling.
• Raise gaps and issues early, with a proposed fix.

Skills

GRC

Risk management

Audits

Documentation

Communications

Cloud security

Automation

Tools

Jira

GitHub

Job description

Upwind Security, Inc. is seeking a GRC Analyst to join our Security & Compliance team and support SOC 2, ISO 27001, NIST, and FedRAMP. You will manage evidence, remediation tracking, and audits across Engineering, IT, Security, Legal, and HR, translating requirements into actionable tasks for tech and business groups.

You’ll help build scalable, AI-assisted GRC processes. The role requires 3–5 years in GRC, strong writing and documentation skills, and a proactive, cross-functional mindset with a