Senior GRC Analyst — Audit, Policy & Risk (Hybrid)

Semperis; Phoenix (AZ); Hybrid; USD 120,000 - 160,000; Full time

Job summary

Semperis seeks a Senior GRC Analyst to lead SOC/ISO/HIPAA audit activities, manage customer security questionnaires, and maintain security policies and standards. You will work with the Head of Risk and Compliance, engineers, and product teams to gather evidence, scope audits, and respond within SLA.

The role includes remediation tracking, FedRAMP support, and building scalable, AI-assisted processes. You will back up vendor risk assessments, define KPIs, and help evolve the GRC program across a

Qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit at a SaaS company.
• Degree in Cybersecurity or one of CISSP/CRISC/CISM/CISA certifications.
• SOC 2 Type II and ISO 27001 audit experience.
• Clear written and verbal communication, with ability to explain technical controls.
• Influence with engineers and stakeholders who do not report to you.

Responsibilities

• Own SOC/ISO/HIPAA audit programs and remediation follow-through.
• Manage customer security questionnaires and due diligence requests.
• Support FedRAMP work and other frameworks as needed.
• Maintain and update information security policies and standards.
• Build reusable, AI-assisted answer libraries and automate evidence collection.
• Back up vendor risk assessments and support the Trust Center when busy.

Skills

GRC experience

Information security

Audits

Stakeholder management

Communication

Education

Cybersecurity degree / CISSP / CRISC / CISM / CISA

Tools

Vanta

Job description

Semperis seeks a Senior GRC Analyst to lead SOC/ISO/HIPAA audit activities, manage customer security questionnaires, and maintain security policies and standards. You will work with the Head of Risk and Compliance, engineers, and product teams to gather evidence, scope audits, and respond within SLA.

The role includes remediation tracking, FedRAMP support, and building scalable, AI-assisted processes. You will back up vendor risk assessments, define KPIs, and help evolve the GRC program across a