Senior GRC Analyst — Hybrid (Austin): Audits & Policy

Semperis; Austin (TX); Hybrid; USD 120,000 - 170,000; Full time

Job summary

Semperis in Austin is seeking a Senior GRC Analyst to manage SOC2 Type II and ISO 27001 audits, governance, and customer security questionnaires. You will own policy upkeep, remediation follow-through, and FedRAMP support, working with engineering, policy, and legal teams in a hybrid environment.

The role requires 5+ years in GRC, CISSP/CRISC/CISM/CISA or cybersecurity degree, and strong communication to explain controls to diverse stakeholders.

Qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit.
• A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA.
• SOC 2 Type II and ISO 27001 audit and attestation experience.
• Clear written and verbal communication with the ability to explain technical control details to engineers, business owners, and customers.

Responsibilities

• Own SOC/ISO/HIPAA audits, customer security questionnaires, and upkeep of security policies and standards.
• Be the day-to-day contact for remediation follow-through on audit findings and support FedRAMP work when needed.
• Manage vendor risk, risk exceptions, and our Trust Center when the queue is heavy.
• Develop and maintain a reusable answer library using AI-assisted, automated, and manual processes.
• Drive remediation timelines with Engineering and escalate blockers when necessary.
• Own policy upkeep and ensure alignment with NIST SP 800-53/CSF, ISO 27001, HIPAA, and SOC 2.

Skills

GRC

Information security

Audits

Communication

Education

Degree in Cybersecurity

Tools

Vanta

Job description

Semperis in Austin is seeking a Senior GRC Analyst to manage SOC2 Type II and ISO 27001 audits, governance, and customer security questionnaires. You will own policy upkeep, remediation follow-through, and FedRAMP support, working with engineering, policy, and legal teams in a hybrid environment.

The role requires 5+ years in GRC, CISSP/CRISC/CISM/CISA or cybersecurity degree, and strong communication to explain controls to diverse stakeholders.