Remote GRC Associate — Part-Time Audit & Compliance

Unit21; United States; Remote; USD 69,000 - 90,000; Part time

Benefits offered by this job

Health insurance

Unlimited PTO

401(k)

Home office setup

Job summary

Unit21 is seeking a part-time GRC Associate to run the day-to-day governance, risk and compliance program. You will own audit evidence, security questionnaire responses, the compliance calendar and vendor reviews, partnering with Security, Sales and Solutions Engineering.

The Head of Security signs off on policy and risk decisions. This role focuses on SOC 2 Type II and PCI DSS, with remote work and an hourly, 6-month term. Hours ~20 per week, US remote, Pacific overlap preferred.

Qualifications

• 2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers.
• Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests.
• Has answered customer security questionnaires or DDQs.
• Clear writing: customer-facing answers should need only light review.
• Organized and persistent; you can track many small asks across teams and follow up without needing escalation.

Responsibilities

• Audit readiness (SOC 2 Type II, PCI DSS).
• Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current.
• Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation.
• Run the biannual and quarterly PCI reviews and track external scan findings to closure.
• Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries.
• Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops.
• Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month).
• Keep the security answers current in the answer library that Solutions Engineering maintains.
• Build a reusable screenshot evidence pack for customers that won't accept Trust Center links.
• Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors.
• Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date.
• Policies, risk and governance: Run the annual review of our security policy set; Manage the security policy exceptions log; Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review; Coordinate the annual BCP/DR test and write the customer-facing summary; Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding.

Skills

GRC experience

Security compliance

IT audit

Compliance automation

Security+

CISA

Tools

Drata

Vanta

Secureframe

OneTrust

Job description

Unit21 is seeking a part-time GRC Associate to run the day-to-day governance, risk and compliance program. You will own audit evidence, security questionnaire responses, the compliance calendar and vendor reviews, partnering with Security, Sales and Solutions Engineering.

The Head of Security signs off on policy and risk decisions. This role focuses on SOC 2 Type II and PCI DSS, with remote work and an hourly, 6-month term. Hours ~20 per week, US remote, Pacific overlap preferred.