Senior GRC Analyst

Averity; New York (NY); On-site; USD 90,000 - 140,000; Full time

Job summary

Averity is seeking a Senior Governance, Risk & Compliance Analyst to strengthen its security and compliance program. This hands-on role focuses on keeping the organization audit-ready, evaluating third-party risk, and turning security requirements into practical processes that teams will follow.

You will conduct risk assessments, identify gaps, collect evidence for PCI DSS and privacy, document controls, and support audits.

Qualifications

• Experience in GRC, IT audit or security compliance.
• Working knowledge of PCI DSS, NIST, SOC 2, or ISO 27001.
• Experience with a GRC platform like Hyperproof, Archer, or OneTrust.

Responsibilities

• Conduct risk assessments of vendors, platforms, and AI tools.
• Identify security/compliance gaps and track remediation through completion.
• Collect and maintain evidence for PCI DSS and privacy requirements.
• Document security controls and monitor their effectiveness.
• Support internal and external audits.
• Update security policies, standards, and baselines.
• Maintain the organizational risk register.
• Support quarterly risk reporting.
• Partner with IT, Engineering, Legal, and other control owners.

Skills

GRC

IT audit

Security compliance

Documentation/communication

Risk management

Collaboration

Tools

Hyperproof

Archer

OneTrust

Job description

We are working with a rapidly growing, technology-driven organization seeking a Senior Governance, Risk & Compliance Analyst to strengthen its security and compliance program.

This is a hands‑on role for someone who knows how to keep an organization audit‑ready, evaluate third‑party risk, and turn security requirements into practical processes that teams will actually follow.

You’ll be responsible for:

• Conducting risk assessments of vendors, technology platforms, and AI tools
• Identifying security and compliance gaps and tracking remediation through completion
• Collecting and maintaining evidence for PCI DSS and privacy requirements
• Documenting security controls and monitoring their effectiveness
• Supporting internal and external audits
• Updating security policies, standards, and control baselines
• Maintaining the organizational risk register
• Supporting quarterly risk reporting
• Partnering with IT, Engineering, Legal, and other control owners

The ideal candidate will bring:

• 3+ years of experience in GRC, IT audit, security compliance, or a closely related area
• Working knowledge of at least one major framework, such as PCI DSS, NIST, SOC 2, or ISO 27001
• Experience using a GRC or governance platform such as Hyperproof, Archer, or OneTrust
• Strong documentation, organization, and written communication skills
• The ability to manage details, follow through, and keep multiple compliance initiatives moving
• A practical, collaborative approach to security and risk management

This is an excellent opportunity for someone who wants meaningful ownership and the ability to grow from strong execution into broader program leadership.