Remote GRC Analyst — SOC 2 & Risk Management

OpenKrill; United States; Remote; USD 92,000 - 113,000; Full time

Benefits offered by this job

Flexible work hours

Flexible vacation

401K match

Parental leave

Team events

Wellness budget

Learning reimbursement

Job summary

YipitData is seeking a GRC Analyst to lead governance, risk, and compliance efforts across security, IT, engineering, and legal teams. You will assess controls, drive evidence collection, and test security measures to prove effectiveness.

This role emphasizes ownership, initiative, and clear communication. You’ll translate complex requirements into actionable steps, support vendor risk reviews, and help shape policies and risk records while collaborating across US-based teams in a

Qualifications

• Experience in security, compliance, risk, audit, privacy, vendor risk.
• Hands-on SOC 2 experience, including Type I/II audits.
• Familiar with SOC 2, NIST CSF or similar frameworks.
• Ability translate requirements into clear actions for teams.

Responsibilities

• Own GRC workstreams from request to evidence collection, testing, remediation, and completion.
• Keep audit readiness throughout the year.
• Test controls and verify they operate as intended.
• Conduct risk assessments and develop actionable remediation plans.
• Coordinate vendor reviews and security questionnaires.
• Translate requirements into clear tasks for non-GRC teams.
• Draft and maintain policies, standards, and risk records.

Skills

SOC 2 experience

Audit coordination

Risk assessment

Security frameworks knowledge

Strong writing skills

Job description

YipitData is seeking a GRC Analyst to lead governance, risk, and compliance efforts across security, IT, engineering, and legal teams. You will assess controls, drive evidence collection, and test security measures to prove effectiveness.

This role emphasizes ownership, initiative, and clear communication. You’ll translate complex requirements into actionable steps, support vendor risk reviews, and help shape policies and risk records while collaborating across US-based teams in a