Remote IT GRC Analyst: SOC 2 & Vendor Risk Lead

Cloud for Good; Northern (KY); Hybrid; USD 70,000 - 110,000; Full time

Benefits offered by this job

Travel up to 30%

Fully remote company

Video meetings via Zoom

Job summary

Cloud for Good seeks an IT GRC Analyst to own the day-to-day operation of the security compliance program. This role coordinates external vendors and auditors, responds to client due-diligence requests, and keeps policies and controls current.

You’ll manage vendor relationships for pen test teams, translate audit findings into remediation actions, and maintain an audit-ready evidence trail across SOC 2 and related frameworks. This is a fully remote role with travel up to 30%.

Qualifications

• 2+ years in a GRC, IT compliance, or security operations role.
• Familiarity with SOC 2 lifecycle and audit processes.
• Experience managing vendors or external service providers.
• Strong written communication for policies and audits.
• Able to coordinate across services, IT, sales and legal.
• Detail-oriented with multiple concurrent deadlines.

Responsibilities

• Serve as the primary point of contact for third-party penetration testing vendors.
• Coordinate scoping, scheduling, and rules of engagement for pen test engagements.
• Review vendor findings and translate into remediation tickets.
• Track remediation timelines and confirm fixes are validated.
• Evaluate and assist in selecting new pen test vendors when needed.
• Own SOC 2 audit coordination with auditors and automation platforms.
• Collect, organize, and submit evidence across control owners.
• Track audit timelines and deliverables; accelerate blockers.
• Maintain an audit-ready evidence trail between cycles.
• Respond to inbound client security questionnaires and due-diligence requests.
• Maintain a library of standard responses, control descriptions and docs.
• Coordinate with sales, legal, and services for non-standard questions.
• Monitor turnaround times and address documentation gaps.

Skills

GRC/IT compliance

Vendor management

Security operations

Written communication

Cross-functional coordination

Tools

SOC 2

Vanta

Drata

Secureframe

Tugboat Logic

Job description

Cloud for Good seeks an IT GRC Analyst to own the day-to-day operation of the security compliance program. This role coordinates external vendors and auditors, responds to client due-diligence requests, and keeps policies and controls current.

You’ll manage vendor relationships for pen test teams, translate audit findings into remediation actions, and maintain an audit-ready evidence trail across SOC 2 and related frameworks. This is a fully remote role with travel up to 30%.