Security Governance Risk & Compliance Analyst I

BigCommerce Pty; Northern (KY); Hybrid; USD 50,000 - 73,000; Full time

Job summary

Commerce, a leader in enterprise risk and compliance, seeks a detail-oriented GRC Analyst for its Governance, Risk & Compliance team. You will support day-to-day risk and compliance operations, assess third-party vendors, maintain policy documentation, and help with audits.

Ideal candidates have 0–2 years in GRC, a related bachelor's degree, and a willingness to learn quickly in a fast-paced environment. Familiarity with Claude Code and AI tooling is a plus.

Qualifications

• 0–2 years of experience in GRC, risk operations, compliance, or related function.
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Business or related field.
• Interest in GRC engineering and willingness to learn quickly in a fast-paced environment.
• Hands-on familiarity with Claude Code or similar AI coding tools, hobby projects welcome.
• Strong written and verbal communication skills for cross-functional work.

Responsibilities

• Support third-party risk assessments by reviewing vendor security questionnaires and due diligence materials.
• Maintain and update the vendor risk register and track remediation through to closure.
• Assist with internal control testing and evidence collection for SOC 2, ISO 27001, PCI-DSS, etc.
• Coordinate audit requests and liaise with internal stakeholders to gather documentation.
• Monitor policy and procedure documentation and flag items due for review or update.
• Track risk exceptions and escalate items requiring senior review.
• Support reporting and metrics for leadership and committee reviews.

Skills

GRC

Risk operations

Compliance

Communication skills

Documentation

Education

Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Business or related field

Tools

Claude Code

AI coding tools

Security tooling

Job description

Welcome to the Agentic Commerce Era At Commerce, our mission is to empower businesses to innovate, grow, and thrive with our open, AI-driven commerce ecosystem. As the parent company of BigCommerce, Feedonomics, and Makeswift, we connect the tools and systems that power growth, enabling businesses to unlock the full potential of their data, deliver seamless and personalized experiences across every channel, and adapt swiftly to an ever-changing market. We believe in harnessing AI responsibly to unlock new possibilities, and we’re looking for individuals who use it intentionally to solve problems, accelerate outcomes, and expand what’s possible in their role. Our purpose is to help businesses confidently solve complex commerce challenges so they can build smarter, adapt faster, and grow on their own terms. If you want to be part of a team of bold builders, sharp thinkers, and technical trailblazers who shape the future of commerce, this is the place for you. We're looking for a detail-oriented and curious GRC Analyst to join our Governance, Risk & Compliance team. In this role, you'll support the day-to-day operations of our risk and compliance program, helping assess third-party vendors, maintain policy documentation, track control evidence, and support audit activities. We're especially interested in candidates who've explored tools like Claude Code and are curious about how AI can be applied to cybersecurity and compliance work. This is a great opportunity for someone early in their career who wants to build a strong foundation in enterprise risk management and information security compliance, joining a senior, globally distributed team that will invest in your growth from day one.

What You’ll Do

• Support third-party risk assessments by reviewing vendor security questionnaires, documentation, and due diligence materials
• Maintain and update the vendor risk register and track remediation activities to closure
• Assist with internal control testing and evidence collection for compliance frameworks (SOC 2, ISO 27001, PCI-DSS, etc.)
• Help coordinate audit requests and liaise with internal stakeholders to gather required documentation
• Monitor policy and procedure documentation, flagging items due for review or update
• Assist in tracking risk exceptions, escalating items that require senior review
• Support reporting and metrics preparation for leadership and committee-level reviews
• Contribute to process improvement initiatives as the program scales

What We’re Looking For

• 0–2 years of experience in GRC, risk operations, compliance, or a related function (internships count)
• Bachelor's degree Computer Science, Cybersecurity, Information Systems, Business, or a related field. Equivalent work experience also considered.
• Genuine interest in GRC engineering and a willingness to learn quickly in a fast-paced environment required
• Hands‑on familiarity with Claude Code or similar AI coding tools, and an ability to think through how they could be applied to cybersecurity or GRC work (hobby projects welcome)
• Strong written and verbal communication skills - you'll be working cross-functionally and with external vendors
• High attention to detail and comfort working with documentation, spreadsheets, and tracking tools
• Proficiency in Microsoft Office or Google Workspace
• Nice To Have Coursework or certification in cybersecurity or risk management (Security+, CISA, etc.)
• Exposure to compliance frameworks such as SOC 2, ISO 27001, NIST, or PCI-DSS
• Experience in an operations or process-driven role (internship or otherwise)

Salary Transparency Range: $49,729.00 - $73,130.00

Where applicable, this role may also be eligible for variable compensation (such as bonus or commission), equity, and benefits in accordance with local policies.

Inclusion and Belonging

At Commerce, we believe that celebrating the unique histories, perspectives and abilities of every employee makes a difference for our company, our customers and our community.

We are an equal opportunity employer and the inclusive atmosphere we build together will make room for every person to contribute, grow and thrive.

We are committed to creating an inclusive and accessible hiring experience for all candidates. If you require accommodations or adjustments at any stage of the recruitment process, please let us know and we will work with you to meet your needs.