Senior GRC Analyst: Audit, Policy & Risk Expert

Semperis; Addison (TX); Ibrido; USD 120.000 - 180.000; Tempo pieno

Vantaggi offerti da questo lavoro

Hybrid work model

Descrizione del lavoro

Semperis is seeking a Senior GRC Analyst to own SOC 2 Type II and ISO 27001 audits, maintain security policies, and drive remediation for audit findings. You will manage customer security questionnaires and support FedRAMP initiatives, collaborating with Product, Eng, and Legal.

The role emphasizes influence, accuracy, and problem solving within a small team. You will back up vendor risk assessments, contribute to KPIs/KRIs, and help automate evidence collection using Vanta and other tools.

Competenze

• 5+ years in GRC, information security risk, compliance, or IT audit, preferably at a SaaS company.
• Certifications such as CISSP, CRISC, CISM, or CISA are valued.
• Experience with SOC 2 Type II and ISO 27001 audits and attestations.
• Clear written and verbal communication, capable of explaining technical controls to engineers and stakeholders.
• Proven ability to influence across teams without direct authority.

Mansioni

• Own SOC2 Type II, ISO 27001 audits, and related evidence collection.
• Manage customer security questionnaires and due diligence requests within SLA.
• Drive remediation tracking with engineering for audit findings and policy gaps.
• Maintain and improve reusable answer libraries using AI-assisted and manual processes.
• Support FedRAMP and other framework requirements as needed.

Conoscenze

GRC experience

Security risk management

Audit knowledge

Vendor risk

Policy development

Communication

Formazione

Cybersecurity degree

CISSP/CRISC/CISM/CISA

Strumenti

Vanta

Drata

ServiceNow

Descrizione del lavoro

Semperis is seeking a Senior GRC Analyst to own SOC 2 Type II and ISO 27001 audits, maintain security policies, and drive remediation for audit findings. You will manage customer security questionnaires and support FedRAMP initiatives, collaborating with Product, Eng, and Legal.

The role emphasizes influence, accuracy, and problem solving within a small team. You will back up vendor risk assessments, contribute to KPIs/KRIs, and help automate evidence collection using Vanta and other tools.