Senior GRC Analyst

VulnU; United States; Remote; USD 175,000 - 190,000; Full time

Benefits offered by this job

Equity

No visa sponsorship

Job summary

Tines is seeking a Senior Governance, Risk, and Compliance Analyst to manage and enhance our compliance programs across SOC 2 Type II, ISO 27001/27701/42001, and FedRAMP. You will collect evidence, test controls, coordinate audits, and automate repetitive tasks using Tines to improve efficiency.

You will partner with cross-functional teams to ensure continuous control monitoring, vendor risk assessments, and responsive customer security assurance while keeping Trust Center documentation current.

Qualifications

• 8-12 years of experience in IT compliance, security, or risk management.
• Hands-on experience implementing or maintaining ISO 27001 compliance.
• Strong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testing.
• Experience supporting FedRAMP certification processes and requirements.
• Experience conducting vendor security assessments and risk analyses.
• Excellent understanding of information security principles, controls, and best practices.

Responsibilities

• Drive audit cycles end to end for SOC 2 Type II and ISO 27001/27701/42001: evidence collection, control testing, auditor liaison, remediation tracking.
• Support FedRAMP efforts, including gap analysis and coordination with 3PAO assessors.
• Operate year-round continuous control monitoring, including drift detection and evidence freshness.
• Run vendor security assessments and mature third-party risk program.
• Conduct risk analyses for systems, processes, and third-party apps; implement controls.
• Respond to customer security inquiries and support Sales on RFPs/RFQs.

Skills

ISO 27001

SOC 2

FedRAMP

Vendor risk assessments

Information security principles

Project management

APIs

Tools

APIs

Job description

# Senior GRC AnalystTines · tines.comCategory: GRC & ComplianceLocation: RemoteLevel: SeniorSalary: $175,000 – $190,000## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* No visa sponsorship* EquityTines is the intelligent workflow company that powers some of the world's most important workflows.Tines has been supporting IT and security teams from a diverse range of customers, including Canva, Reddit, SAP, Coinbase, Mars, Fin (Intercom), and McKesson.Tines 3B, launched in 2026, is the next generation of Tines – a single, secure environment for every team’s apps, agents and automations.As an integrator across the entire tech stack, Tines is vendor-agnostic integrating with any API-enabled service. This flexibility enables our customers to achieve their highest-priority goals faster. Tines has security woven into its DNA, and our platform is secure and private by design.At Tines, we're driven by our values of Simplicity, Speed, and Soundness. We're committed to delivering exceptional customer experiences while fostering a company culture that nurtures individual curiosity, growth, and integrity. We’re excited about what’s next, and we’re looking for others to join us on our journey.Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to help execute and operate our compliance programs during a pivotal growth phase. Reporting to our Director of GRC, you will work across our commercial certifications — SOC 2 Type II and ISO 27001, 27701 and 42001 — and our FedRAMP program, while supporting vendor risk management and customer security assurance.This is a hands-on execution role. You'll partner with our Staff GRC Analysts, who set certification strategy, and own the operational delivery behind it: collecting evidence, testing controls, running audit cycles, assessing vendors, and answering the security questions our customers and prospects ask. You'll also have a real mandate to automate the parts of this work that shouldn't be manual, using Tines itself.Location: Based remotely in the United States.What you’ll be doing:Certification and Audit Execution — Drive audit cycles end to end for SOC 2 Type II and ISO 27001 / 27701 / 42001: evidence collection, control testing, auditor liaison, and remediation tracking. Support gap assessments for net-new certifications we're evaluating.FedRAMP Program Support — Support our FedRAMP efforts, including gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors.Continuous Control Monitoring — Operate the year-round monitoring cadence that keeps certifications live between audits — scan and pen test reporting, control drift detection, and evidence freshness.Vendor Risk Management — Run vendor security assessments, evaluating security controls and compliance posture before acquisition, and help mature our third-party risk program.Risk Assessment and Management — Conduct risk analyses for systems, processes, and third-party applications, and implement appropriate controls to mitigate identified risks.Customer Security Assurance — Respond to customer security inquiries, questionnaires, and audit requests, and support Sales on RFPs and RFQs. Keep our Trust Center documentation current.Contract Review and Management — Partner with Legal to review contracts for security and compliance requirements, ensure appropriate security provisions are included, identify compliance risks and recommend mitigating controls. Help develop standardized security language for various contract types.Compliance Automation — Use Tines to streamline compliance processes, evidence collection and reporting, and reduce the manual load on the team.Policy Development and Maintenance — Review, update and develop security policies and procedures aligned with regulatory requirements and industry best practices.Cross-functional Collaboration — Partner with Engineering, Product, IT, Legal, HR and leadership to embed compliance requirements into organizational processes.Regulatory Monitoring — Stay current with evolving compliance standards and regulatory requirements relevant to our business and our customers.What you bring with you:8-12 years of experience in IT compliance, security, or risk managementHands-on experience implementing or maintaining ISO 27001 complianceStrong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testingExperience supporting FedRAMP certification processes and requirementsExperience conducting vendor security assessments and risk analysesExcellent understanding of information security principles, controls, and best practicesStrong project management skills, with the ability to manage multiple compliance initiatives simultaneouslyExceptional communication skills for translating technical requirements to non-technical stakeholdersPrevious experience on the audit side — at a 3PAO or audit firm (e.g. Coalfire, Schellman, KPMG) — or driving gap remediation for certification readinessIndustry certifications such as CISSP, CISA, or CISMExperience with compliance automation tools and techniques, or scripting/API experience for evidence automationContinuous monitoring (ConMon) and compliance reporting experienceKnowledge of cloud security principles and controls (AWS, Azure, GCP)Experience reviewing contracts for security and compliance requirementsExperience in SaaS or technology companiesFamiliarity with privacy regulations (GDPR, CCPA)Experience working in remote-first environmentsTarget Annual Compensation: $175,000-190,000Applicants for this opportunity must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.#LI-JF1At Tines, we’re all about trying new things and taking the leap. If you’re second-guessing your application, we hope you’ll trust your gut and take the leap too! Applying for a new job isn’t always easy, especially if you’re thinking of a career pivot – but we’re big believers in learning and growth here at Tines, so you’ve nothing to worry about. A variety of experience, perspectives, and voices makes us the company we are. We’d love to hear from you.Tines provides equal employment opportunities to all employees and applicants for employment without regard to sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation.