Senior GRC Analyst - Central or Eastern time, US or Canada

shifttechnology; United States; Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Remote or Hybrid flexibility

Paid time off and holidays

Learning opportunities

Mental health support

Paid volunteering days

Job summary

Shift Technology is seeking a senior professional to lead an information security and privacy governance, risk, and compliance program. You will drive policy, controls, audits, privacy assessments, and third-party reviews in partnership with technical and business teams to reduce risk and maintain customer confidence.

In this role you will coordinate ISO 27001 and SOC 2 Type II audits, assess suppliers, support customer assurance requests, and help implement data handling and privacy notices

Qualifications

• 7+ years in GRC, IT audit, security assurance, or information security.
• Relevant degree or equivalent professional experience.
• Experience delivering audits and certifications from start to finish.
• Deep knowledge of ISO 27001, ISO 27701, SOC 2 Type II, HITRUST, or NIST CSF.

Responsibilities

• Turn security expectations into practical policies, standards, and procedures, and support organization-wide security awareness.
• Work with privacy stakeholders on data handling policies, privacy notices, and impact assessments for new initiatives.
• Maintain the security assurance plan; identify risks with engineering and business teams, evaluate controls, and review new designs.
• Coordinate ISO 27001 and SOC 2 Type II audits, assemble evidence, and track remediation through completion.
• Assess suppliers' security practices and follow up on identified risks; support customer assurance requests and data access requests.

Skills

GRC

IT audit

Security assurance

Information security

Education

Relevant degree or equivalent

Job description

Role overview

Lead work across an information security and privacy governance, risk, and compliance program. The role covers policy and control assurance, audits, privacy assessments, and third-party reviews, partnering with technical and business teams to reduce risk and maintain customer confidence.

Responsibilities

• Turn security expectations into practical policies, standards, and procedures, and support organization-wide security awareness.
• Work with privacy stakeholders on data handling policies, privacy notices, and impact assessments for new initiatives.
• Maintain the security assurance plan; identify risks with engineering and business teams, evaluate controls, and review new designs.
• Coordinate ISO 27001 and SOC 2 Type II audits, assemble evidence, and track remediation through completion.
• Assess suppliers' security practices and follow up on identified risks; support customer assurance requests and data access requests.

Requirements

• At least seven years in GRC, IT audit, security assurance, or information security.
• A relevant degree or equivalent professional experience.
• Experience delivering work in a regulated industry, such as financial services or healthcare.
• Direct experience managing or supporting formal audits and certifications from start to finish.
• Deep knowledge of security and privacy frameworks, including ISO 27001, ISO 27701, SOC 2 Type II, HITRUST, or NIST CSF.

Nice to have

• Certifications such as CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, or CISSP.

Benefits and work setup

• Remote or hybrid flexibility; the role is listed for candidates in US or Canada Central or Eastern time zones.
• Stated base salary range: $120,000-$150,000 USD, with additional incentive pay and benefits.
• Paid time off and holidays, learning opportunities, mental health support, and paid volunteering days.