Remote Senior GRC Analyst — AI-Driven Security & Compliance

Remote; San Francisco (CA); Remote; USD 155,000 - 185,000; Full time

Job summary

Garner is seeking a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner’s security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program.

This role will partner with all departments to identify risks early, drive remediation, and

Qualifications

• 5+ years of experience in GRC, IT risk management, third party risk management, or information security compliance.
• Experience running information security risk assessments and maintaining a risk register using established methodologies such as NIST CSF or ISO 27005.
• Hands on experience with vendor risk management and with vulnerability or findings remediation programs in a cloud native engineering environment.
• Working knowledge of HIPAA and of SOC 2, ISO 27001, and HITRUST requirements.
• A track record of driving accountability across teams you don’t manage, and the ability to adapt your communication style across engineers, operators, and executives.
• A GRC Engineering mindset with prior experience using scripting and LLMs to automate repetitive tasks.
• A desire to be part of a high-performing, mission-driven team with urgency and accountability.
• Industry certifications such as CISA, CISM, CISSP, CRISC, or ISO 27001 Lead Auditor preferred.

Responsibilities

• Own Garner’s annual information security risk assessment and risk register, driving risk identification, scoring, treatment, and reporting.
• Manage risk exceptions and prepare risk acceptances for leadership decision.
• Run third party and vendor risk reviews from intake through approval and periodic reassessment.
• Own security findings from vulnerability scanning, penetration tests, audits, client assessments, and incidents, tracking remediation with Engineering, enforcing SLAs, and escalating findings that warrant a risk decision.
• Run our security and compliance training program, including annual security awareness and HIPAA training, onboarding, content refreshes, and completion tracking.
• Manage the maintenance of our compliance policies, standards, and procedures.
• Report on our compliance posture to senior leadership.
• Scale our GRC function with AI and automation, building quick wins and scoping requirements for Engineering to fully automate the rest.

Skills

GRC expertise

Risk assessment

Vendor risk mgmt

HIPAA compliance

Cross‑functional communication

Automation with scripting/LLMs

Accountability culture

Audit reporting

Education

CISA

CISM

CISSP

CRISC

ISO 27001 Lead Auditor

Tools

AWS

Okta

Wiz

Retool

Gitlab

Vanta

Claude

Job description

Garner is seeking a Senior GRC Analyst to join our Technical Compliance team and own the recurring risk, vendor, findings, and governance work that keeps Garner’s security program operating well between audits. You will run our risk risk register, manage third party risk, drive security findings to resolution, deliver security training and run the operating cadence of our security governance program.

This role will partner with all departments to identify risks early, drive remediation, and