Senior GRC Analyst | Remote ISO 27001 & SOC 2 Expert

shifttechnology; United States; Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Remote or Hybrid flexibility

Paid time off and holidays

Learning opportunities

Mental health support

Paid volunteering days

Job summary

Shift Technology is seeking a senior professional to lead an information security and privacy governance, risk, and compliance program. You will drive policy, controls, audits, privacy assessments, and third-party reviews in partnership with technical and business teams to reduce risk and maintain customer confidence.

In this role you will coordinate ISO 27001 and SOC 2 Type II audits, assess suppliers, support customer assurance requests, and help implement data handling and privacy notices

Qualifications

• 7+ years in GRC, IT audit, security assurance, or information security.
• Relevant degree or equivalent professional experience.
• Experience delivering audits and certifications from start to finish.
• Deep knowledge of ISO 27001, ISO 27701, SOC 2 Type II, HITRUST, or NIST CSF.

Responsibilities

• Turn security expectations into practical policies, standards, and procedures, and support organization-wide security awareness.
• Work with privacy stakeholders on data handling policies, privacy notices, and impact assessments for new initiatives.
• Maintain the security assurance plan; identify risks with engineering and business teams, evaluate controls, and review new designs.
• Coordinate ISO 27001 and SOC 2 Type II audits, assemble evidence, and track remediation through completion.
• Assess suppliers' security practices and follow up on identified risks; support customer assurance requests and data access requests.

Skills

GRC

IT audit

Security assurance

Information security

Education

Relevant degree or equivalent

Job description

Shift Technology is seeking a senior professional to lead an information security and privacy governance, risk, and compliance program. You will drive policy, controls, audits, privacy assessments, and third-party reviews in partnership with technical and business teams to reduce risk and maintain customer confidence.

In this role you will coordinate ISO 27001 and SOC 2 Type II audits, assess suppliers, support customer assurance requests, and help implement data handling and privacy notices