Senior GRC Analyst - Audit, Risk & Automation

Turing; United States; On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Frontier AI projects

Conference exposure

Collaborative team environment

Job summary

Turing, headquartered in San Francisco, is seeking a Senior GRC Analyst to lead governance, risk, and compliance activities across the company and serve as a trusted partner to engineering and business teams as they meet security obligations.

You will own audits (SOC 2, ISO 27001), maintain a robust control framework, run risk assessments, and manage vendor risk, enabling scalable security across our enterprise workloads.

Qualifications

• 4+ years in GRC, compliance, audit, or risk.
• Hands-on experience supporting or leading SOC 2 and/or ISO 27001 audits.
• Understanding of control frameworks and risk assessment methodologies.
• Experience with vendor risk management and risk-based controls.

Responsibilities

• Own and coordinate compliance audits and certifications (SOC 2, ISO 27001, and others).
• Maintain and improve our control framework, mapping controls across multiple frameworks.
• Conduct risk assessments—identifying, documenting, and tracking risks to resolution.
• Run the vendor/third-party risk program: security reviews of vendors and ongoing monitoring.
• Support customer security reviews and questionnaires, and help maintain the trust center.
• Develop, maintain, and socialize security policies and standards.
• Partner with control owners across the company to ensure controls are operating effectively, and drive remediation when they aren't.
• Identify opportunities to automate manual GRC work and partner with GRC engineering to implement them.

Skills

GRC operations

Organizational skills

Attention to detail

Clear communication

Multi-workstream management

Education

CISA

CISSP

CIPP

Tools

GRC tooling

Job description

Turing, headquartered in San Francisco, is seeking a Senior GRC Analyst to lead governance, risk, and compliance activities across the company and serve as a trusted partner to engineering and business teams as they meet security obligations.

You will own audits (SOC 2, ISO 27001), maintain a robust control framework, run risk assessments, and manage vendor risk, enabling scalable security across our enterprise workloads.