Security GRC Analyst: Remote-Ready, High-Impact Compliance

Whatnot; Los Angeles (CA); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Holiday and time off

Health insurance

Work from home

Home office setup

Cell phone allowance

Internet allowance

Wellness allowance

Childcare allowance

Pension / 401k

Parental leave

Dogfood budget

Job summary

Whatnot is seeking a Governance, Risk, & Compliance Analyst to strengthen security governance, risk management, and regulatory compliance across our platforms. You will define security requirements, coordinate with partner teams, and lead audit programs to demonstrate trust with regulators and customers.

Ideal candidates bring 5+ years in security governance and a strong track record with ISO 27001, SOC 2, PCI, and GDPR/CCPA, plus cloud-centric audit experience.

Qualifications

• Minimum 5+ years of relevant experience in security governance, risk, and compliance.
• Bachelor’s degree in Computer Science, Information Security, or a related field.
• Deep knowledge of security best practices and standards such as ISO 27001, SOC2, PCI, and GDPR/CCPA.
• Experience at a Big 4 firm or similar audit firm.
• Experience in supporting complex third party audit projects in a cloud-centric environment.
• Excellent written communication skills to document, communicate, and report security assessments.
• Experience creating and running a security risk management program that balances security with business priorities.

Responsibilities

• Review secure configurations across tools like Okta, Terraform, AWS, Lumos, Cloudflare, and Github.
• Develop security requirements for partner teams and drive execution.
• Prepare for and run external security audits.
• Shape the strategic direction of the Security GRC team.
• Lead the security risk management program and ensure mitigations are implemented.

Skills

Security governance

Security risk management

ISO 27001

SOC 2

PCI DSS

GDPR/CCPA

Audit experience

Cloud security

Written communication

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

None

Job description

Whatnot is seeking a Governance, Risk, & Compliance Analyst to strengthen security governance, risk management, and regulatory compliance across our platforms. You will define security requirements, coordinate with partner teams, and lead audit programs to demonstrate trust with regulators and customers.

Ideal candidates bring 5+ years in security governance and a strong track record with ISO 27001, SOC 2, PCI, and GDPR/CCPA, plus cloud-centric audit experience.