Senior GRC Analyst: AI Security & Compliance Leader

Shift Technology; New York (NY); Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Remote and hybrid options

Learning & development opportunities

Generous PTO & holidays

Mental health benefits

Volunteer days

Job summary

Shift Technology is seeking a Senior GRC Analyst to architect and manage a unified governance, risk, and compliance program within its Information Security team. You will drive policy, risk assessments, DPIAs, and third‑party security programs to protect customer data and regulatory posture.

You will coordinate internal and external audits (ISO 27001, SOC 2 Type II) and partner with DPOs to ensure privacy protections, while communicating risk to stakeholders and leadership.

Qualifications

• 7+ years of experience in a GRC, IT Audit, Security Assurance, or Information Security role.
• Bachelor’s Degree in a relevant field or equivalent work experience.
• Professional certifications such as CIPP/E, CIPP/US, CIPT CISA, CISM, CRISC, or CISSP are highly desirable.

Responsibilities

• Develop and maintain the security assurance plan to meet Shift policies and standards.
• Improve third-party information security assurance and continual assessment.
• Identify risk areas and facilitate security control evaluations and testing.
• Review architectural designs to align with security policies and mitigate risk.
• Support DPIAs for new products and initiatives.
• Manage and coordinate audits for certifications like ISO 27001 and SOC 2 Type II.

Skills

GRC experience

Audit management

Compliance knowledge

Education

Bachelor’s degree in a relevant field

CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, or CISSP

Tools

Drata

Job description

Shift Technology is seeking a Senior GRC Analyst to architect and manage a unified governance, risk, and compliance program within its Information Security team. You will drive policy, risk assessments, DPIAs, and third‑party security programs to protect customer data and regulatory posture.

You will coordinate internal and external audits (ISO 27001, SOC 2 Type II) and partner with DPOs to ensure privacy protections, while communicating risk to stakeholders and leadership.