Senior GRC Analyst: Audit, Policy & Risk Lead (Hybrid)

Semperis; Austin (TX); Hybrid; USD 110,000 - 140,000; Full time

Job summary

Semperis is seeking a Senior GRC Analyst to own core programs including SOC/ISO/HIPAA audits, customer security questionnaires, and governance policy upkeep. You will collaborate with Risk, Compliance, and Engineering to ensure controls are effective and audit evidence is prepared on schedule.

This role requires strong communication, the ability to influence without authority, and SaaS experience. Hybrid work across Hoboken, Addison, Phoenix, or Austin, with opportunities to shape security

Qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit at a SaaS company.
• Degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA.
• SOC 2 Type II and ISO 27001 audit and attestation experience.
• Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers.
• A track record of getting results through influence with engineers and other stakeholders who don't report to you.

Responsibilities

• Own SOC/ISO/HIPAA audits and customer security questionnaires.
• Remediation follow through on audit findings with Engineering and Risk teams.
• Maintain up-to-date security policies and standards (NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, SOC 2).
• Support FedRAMP program and other frameworks as needed.
• Collaborate with policy owners, People Operations, and Legal on reviews and approvals.

Skills

GRC experience

Info security risk

IT audit

Compliance know-how

SaaS familiarity

Education

Cybersecurity degree

CISSP

CRISC

CISM

CISA

Tools

Vanta

GRC tooling

Drata

OneTrust

ServiceNow

Job description

Semperis is seeking a Senior GRC Analyst to own core programs including SOC/ISO/HIPAA audits, customer security questionnaires, and governance policy upkeep. You will collaborate with Risk, Compliance, and Engineering to ensure controls are effective and audit evidence is prepared on schedule.

This role requires strong communication, the ability to influence without authority, and SaaS experience. Hybrid work across Hoboken, Addison, Phoenix, or Austin, with opportunities to shape security