Remote Senior GRC Analyst: ISO 27001 & SOC 2 Focus

VulnU; Denver (CO); Remote; USD 115,000 - 159,000; Full time

Benefits offered by this job

Paid parental leave

Learning budget

Job summary

Ping Identity is hiring a Senior GRC Analyst to drive and enhance our global governance, risk, and compliance program. The role focuses on risk assessments, policy governance, audit support, third-party risk oversight, and remediation efforts across enterprise and product lines.

You will report to the GRC Manager and collaborate with Engineering, Privacy, Legal, and other teams to translate regulatory obligations into practical, business-aligned controls that strengthen our security posture.

Qualifications

• Hands-on experience supporting ISO 27001 and SOC 2 audits, including evidence gathering and auditor engagement.
• Strong understanding of risk management principles and structured risk assessments.
• Experience reviewing and testing security controls across cloud environments.
• Familiarity with third-party risk management processes and supplier assurance.
• Ability to translate regulatory requirements into practical guidance for teams.

Responsibilities

• Own and support key components of Ping Identity’s global GRC programme, ensuring alignment with ISO 27001, SOC 2, and relevant obligations.
• Lead and conduct enterprise and product-level risk assessments with stakeholders.
• Support external audits and certifications, including evidence collection and auditor coordination.
• Develop and maintain security policies, standards, and procedures.
• Track and report compliance metrics, audit findings, and remediation progress to leadership.

Skills

GRC expertise

Risk assessments

Audits

Cloud platforms

Third-party risk

Communication

Education

CISM

CISSP

Job description

Ping Identity is hiring a Senior GRC Analyst to drive and enhance our global governance, risk, and compliance program. The role focuses on risk assessments, policy governance, audit support, third-party risk oversight, and remediation efforts across enterprise and product lines.

You will report to the GRC Manager and collaborate with Engineering, Privacy, Legal, and other teams to translate regulatory obligations into practical, business-aligned controls that strengthen our security posture.