Remote GRC Associate - SOC 2 & PCI Readiness

Unit21, Inc.; United States; Remote; USD 69,000 - 90,000; Part time

Job summary

Unit21, Inc. is seeking a part-time GRC Associate to manage governance, risk and compliance operations.

This remote role handles audit evidence, security questionnaire responses, the compliance calendar and vendor reviews, working with Security, Sales and Solutions Engineering. You will coordinate SOC 2 Type II and PCI DSS activities, run Drata workflows, chase owners to close gaps, and keep the trust center updated.

Qualifications

• 2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers
• Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests
• Has answered customer security questionnaires or DDQs
• Clear writing: customer-facing answers should need only light review
• Organized and persistent; you can track many small asks across teams and follow up without needing escalation

Responsibilities

• Audit readiness for SOC 2 Type II and PCI DSS
• Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current
• Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation
• Run the biannual and quarterly PCI reviews and track external scan findings to closure
• Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries
• Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops
• Customer trust and sales support
• Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month). These include SIG, CAIQ and custom bank questionnaires, often submitted through customer portals such as LogicGate, Aravo and Coupa.
• Keep the security answers current in the answer library that Solutions Engineering maintains. New or changed security claims get Security sign-off before they go out.
• Build a reusable screenshot evidence pack for customers that won't accept Trust Center links
• Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors
• Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date
• Policies, risk and governance
• Run the annual review of our security policy set
• Manage the security policy exceptions log
• Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review
• Coordinate the annual BCP/DR test and write the customer-facing summary
• Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding
• Third-party risk management
• Run security assessments of internal-use and non-critical vendors. Support the Head of Security on critical vendor and subprocessor reviews, including annual reviews.
• Keep the subprocessor list accurate and drive customer notifications when it changes
• Run the intake and review process for new SaaS apps, OAuth apps, AI tools and MCP servers
• Partner compliance and program structure
• Handle day-to-day compliance work for our data-provider reseller agreements, starting with LexisNexis: customer credentialing, audit readiness and reporting
• Build and run a compliance calendar of recurring controls, reviews, audits and renewals, with named owners
• Send a monthly GRC status report to the Head of Security

Skills

GRC

IT audit

Regulatory compliance

Security questionnaires

Tools

Drata

Vanta

Secureframe

OneTrust

LogicGate

Aravo

Coupa

Job description

Unit21, Inc. is seeking a part-time GRC Associate to manage governance, risk and compliance operations.

This remote role handles audit evidence, security questionnaire responses, the compliance calendar and vendor reviews, working with Security, Sales and Solutions Engineering. You will coordinate SOC 2 Type II and PCI DSS activities, run Drata workflows, chase owners to close gaps, and keep the trust center updated.