Senior GRC Analyst — Hybrid, Audit & Policy Leader

Semperis; Hoboken (NJ); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Semperis in Hoboken, NJ is seeking a Senior GRC Analyst to own SOC2 Type II, ISO 27001 audits, HIPAA, and FedRAMP support. You will manage customer trust programs, remediation follow-through, and policy governance, collaborating with Engineering, Legal, and Product to strengthen controls.

You’ll work with Head of Risk and Compliance, build a reusable answer library, and back up vendor risk assessments. Requires 5+ years in GRC, CISSP/CRISC/CISM/CISA, and experience at a SaaS company.

Qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
• A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA.
• SOC 2 Type II and ISO 27001 audit and attestation experience.
• Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers.
• A track record of getting results through influence with engineers and other stakeholders who don't report to you.

Responsibilities

• Own three core programs: SOC/ISO/HIPAA Audits, customer security questionnaires and upkeep of security policies and standards.
• Be the day-to-day point of contact for remediation follow through on audit findings, and support FedRAMP work during certification phases.
• Back up teammates on vendor risk, risk exceptions, and the Trust Center; assist with complex questionnaires.
• Run programs independently, propose scoping, policy, and higher-risk decisions to Head of Risk and Compliance, and drive results through influence.

Skills

GRC experience

Info security risk

Compliance

IT audit

Cybersecurity

Education

Cybersecurity degree

CISSP

CRISC

CISM

CISA

Tools

Vanta

Job description

Semperis in Hoboken, NJ is seeking a Senior GRC Analyst to own SOC2 Type II, ISO 27001 audits, HIPAA, and FedRAMP support. You will manage customer trust programs, remediation follow-through, and policy governance, collaborating with Engineering, Legal, and Product to strengthen controls.

You’ll work with Head of Risk and Compliance, build a reusable answer library, and back up vendor risk assessments. Requires 5+ years in GRC, CISSP/CRISC/CISM/CISA, and experience at a SaaS company.