Senior GRC Analyst

Crusoe Energy Systems; San Francisco (CA); On-site; USD 170,000 - 230,000; Full time

Benefits offered by this job

Health benefits

PTO

401(k) match

Mental wellness

Job summary

Crusoe Energy Systems in San Francisco seeks a Sr. GRC Analyst to own the day-to-day governance, risk, and compliance program, including SOX ICFR, audit evidence, and vendor risk, while driving security and privacy controls.

You will operate independently, manage full audit cycles, and partner with IT, Security, Finance, and Engineering to implement control improvements and evidence collection. Experience with AI-assisted tooling is valued.

Qualifications

• 5–7 years of experience in GRC, information security, or IT audit.
• SOX and ICFR understanding; able to drive end-to-end audits.
• Experience with SOC 2, ISO 27001, HIPAA, or NIST CSF.
• Strong communication and stakeholder management.

Responsibilities

• Own and drive day-to-day GRC program execution across security and privacy controls.
• Lead SOX ITGCs design, operation, and testing; maintain control docs.
• Coordinate audit cycles; respond to evidence requests and auditor inquiries.
• Modernize GRC processes with AI and automation to improve efficiency.

Skills

GRC experience

SOX knowledge

Audit management

Policy management

AI tools familiarity

Vendor risk

ITGCs

Customer questionnaires

UARs

Education

CISA

CRISC

CISSP

Tools

Vanta

Drata

AuditBoard

Job description

• Crusoe is seeking a Sr. GRC Analyst to own and drive the day-to-day execution of our Governance, Risk, and Compliance program
• Reporting to the Head of GRC, this role is responsible for running core compliance operations across our security and privacy frameworks, from user access reviews and audit evidence to customer trust support and vendor risk, while also bringing SOX expertise to the IT controls that underpin our internal controls over financial reporting (ICFR), from gap identification through remediation
• You’ll be the engine behind our continuous compliance posture: keeping audits on track, maintaining policies and standards, responding to customer security inquiries, and driving improvements across our GRC platform
• As a senior member of the team, you’ll be expected to operate independently, take ownership of full audit cycles, and partner confidently with stakeholders across IT, Security, Finance, and Engineering
• Applying expertise in SOX audit requirements to support the design, operation, and testing of IT general controls (ITGCs), including access management, change management, and computer operations, and maintaining the related control documentation, process narratives, and risk-control matrices
• Evaluating in-scope systems and processes to identify SOX control gaps, and partnering closely with control owners across IT, Finance, and Engineering to design and drive remediation plans with clear ownership and timelines through to closure
• Collecting, organizing, and delivering audit evidence for SOX, SOC 2, ISO 27001, HIPAA, and other framework requirements
• Partnering with internal control owners to ensure evidence is accurate, current, and audit-ready
• Acting as a day-to-day point of contact for internal and external auditors, managing requests and facilitating walkthroughs
• Responding to evidence and documentation requests for various strategic initiatives
• Owning the coordination and completion of User Access Reviews (UARs) across in-scope systems and applications on a recurring schedule, including those supporting financial reporting
• Maintaining and updating organizational security policies and standards to reflect current regulatory and business requirements
• Conducting third-party security assessments and supporting review of vendor contracts for compliance with security requirements
• Responding to customer security questionnaires and due diligence requests within established SLAs
• Maintaining and updating the Security Diligence Playbook to ensure responses are consistent, accurate, and efficient
• Driving enhancements within our GRC tool, including asset management, integrations, test configurations, control mapping, review workflows, and risk objects
• Identifying opportunities to streamline and automate repetitive GRC workflows, including continuous control monitoring
• Applying AI and LLM-based tools to improve productivity across compliance operations, such as accelerating questionnaire responses, summarizing audit evidence, or drafting policy updates
• Tracking and reporting on compliance metrics and control health to GRC leadership

Benefits

• Health & wellbeing: Comprehensive health benefits designed to support your overall wellness
• Time away: Paid time off for vacations, family bonding, and unexpected needs
• 401(k) match: Build your financial future with our 401(k) matching program
• Mental wellness: Resources and support for your emotional wellbeing and navigating life’s challenges

The ideal candidate is proactive, detail-oriented, and brings a mindset for efficiency, leveraging AI tools and automation to reduce manual effort and scale their impact across the programHighly organized, self-directed, and able to manage multiple priorities and stakeholders independentlyPractical knowledge of compliance frameworks such as SOC 2, ISO 27001, HIPAA, and NIST CSFDetail-oriented with strong follow-through on recurring operational tasksFamiliarity with responding to customer security questionnaires and managing trust center contentHands-on experience with GRC platforms (Vanta preferred; Drata, AuditBoard, or similar also valued)Comfort using AI tools (e.g., Gemini, Claude, Copilot) to accelerate day-to-day work and improve operational efficiencyExperience conducting user access reviews, vendor risk assessments, and internal audits5–7 years of experience in GRC, information security, IT audit, or a related compliance role, with demonstrated ownership of end-to-end audit cyclesSolid understanding of SOX 404 audit requirements and IT general controls, with hands-on experience identifying control gaps and working with stakeholders to remediate themStrong written and verbal communication skills with the ability to translate compliance requirements for both technical and non-technical audiences; skilled at influencing control owners without direct authorityCertifications such as CISA, CRISC, CISSP, Security+, or ISO 27001 Lead AuditorBackground from public accounting and/or high-growth technology companies navigating SOX complianceFamiliarity with financial systems (ERP, billing, or revenue recognition platforms)Experience mentoring junior analysts or leading cross-functional compliance initiativesExperience with policy management and security awareness training platformsExperience with cloud environments (GCP preferred; AWS/Azure exposure helpful)Familiarity with AI risk assessment frameworks and emerging AI governance practices