Senior GRC Analyst — Remote (Equity Options)

Tines Security Ltd.; United States; Remote; USD 175,000 - 190,000; Full time

Benefits offered by this job

Startup equity & extended exercise

Matching retirement plans

Home office setup

25 days annual leave

Generous parental leave programs

Flexibility in how and where you work

Phone and home Internet allowance

Job summary

Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to lead our compliance program during a pivotal growth phase. You’ll drive certification cycles, partner with cross-functional teams, and automate evidence collection using Tines.

Location: based remotely in the United States, supporting SOC 2 Type II, ISO 27001/27701/42001, and FedRAMP. You’ll collaborate with Staff GRC Analysts and Legal to ensure security provisions in contracts, respond to customer

Qualifications

• 8-12 years of experience in IT compliance, security, or risk management.
• Hands-on experience implementing or maintaining ISO 27001 compliance.
• Strong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testing.
• Experience supporting FedRAMP certification processes and requirements.
• Experience conducting vendor security assessments and risk analyses.
• Excellent understanding of information security principles, controls, and best practices.
• Strong project management skills, with the ability to manage multiple compliance initiatives simultaneously.
• Exceptional communication skills for translating technical requirements to non-technical stakeholders.
• Previous experience on the audit side — at a 3PAO or audit firm (e.g. Coalfire, Schellman, KPMG) — or driving gap remediation for certification readiness.
• Industry certifications such as CISSP, CISA, or CISM.
• Experience with compliance automation tools and techniques, or scripting/API experience for evidence automation.
• Continuous monitoring (ConMon) and compliance reporting experience.
• Knowledge of cloud security principles and controls (AWS, Azure, GCP).
• Experience reviewing contracts for security and compliance requirements.
• Experience in SaaS or technology companies.
• Familiarity with privacy regulations (GDPR, CCPA).
• Experience working in remote-first environments.

Responsibilities

• Certification and Audit Execution — Drive audit cycles end to end for SOC 2 Type II and ISO 27001 / 27701 / 42001: evidence collection, control testing, auditor liaison, and remediation tracking.
• FedRAMP Program Support — Support our FedRAMP efforts, including gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors.
• Continuous Control Monitoring — Operate the year-round monitoring cadence that keeps certifications live between audits — scan and pen test reporting, control drift detection, and evidence freshness.
• Vendor Risk Management — Run vendor security assessments, evaluating security controls and compliance posture before acquisition, and help mature our third-party risk program.
• Risk Assessment and Management — Conduct risk analyses for systems, processes, and third-party applications, and implement appropriate controls to mitigate identified risks.
• Customer Security Assurance — Respond to customer security inquiries, questionnaires, and audit requests, and support Sales on RFPs and RFQs. Keep our Trust Center documentation current.
• Contract Review and Management — Partner with Legal to review contracts for security and compliance requirements, ensure appropriate security provisions are included, identify compliance risks and recommend mitigating controls. Help develop standardized security language for various contract types.
• Compliance Automation — Use Tines to streamline compliance processes, evidence collection and reporting, and reduce the manual load on the team.
• Policy Development and Maintenance — Review, update and develop security policies and procedures aligned with regulatory requirements and industry best practices.
• Cross-functional Collaboration — Partner with Engineering, Product, IT, Legal, HR and leadership to embed compliance requirements into organizational processes.
• Regulatory Monitoring — Stay current with evolving compliance standards and regulatory requirements relevant to our business and our customers.

Job description

Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to lead our compliance program during a pivotal growth phase. You’ll drive certification cycles, partner with cross-functional teams, and automate evidence collection using Tines.

Location: based remotely in the United States, supporting SOC 2 Type II, ISO 27001/27701/42001, and FedRAMP. You’ll collaborate with Staff GRC Analysts and Legal to ensure security provisions in contracts, respond to customer