Senior GRC Analyst: SOC 2, NIST, AI-Driven Evidence

Suno; San Francisco (CA); In loco; USD 180.000 - 240.000; Tempo pieno

Descrizione del lavoro

Suno is seeking a Staff Security GRC Analyst to build Suno's security compliance program from the ground up. You'll report to the CISO and own the control framework that ties SOC 2 and NIST CSF together, working with AppSec and InfraSec to ensure controls are effective.

You’ll automate evidence collection with scripts and AI, run SOC 2 readiness end to end, and partner with Legal and Product to answer customer security questionnaires.

Competenze

• 7–9 years in GRC, security compliance, or IT audit.
• Hands-on, end-to-end ownership of a security compliance program as its primary owner.
• Deep working knowledge of SOC 2 and NIST CSF, including control mapping and audit mechanics.
• Enough technical fluency to read a cloud configuration and judge enforcement of controls.
• Comfort building automation with scripts or AI tools.

Mansioni

• Build and own Suno's security control framework, mapping controls to SOC 2, NIST CSF, and future frameworks.
• Lead SOC 2 preparation end to end, from gap assessments to remediation with owners and auditor.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools.
• Run vendor security reviews, keep security policies current, and answer customer security questionnaires with Product and Legal.
• Partner with the CISO to provide leadership with an evidencer-backed view of security posture.
• Help earn trust of partners and customers to broaden Suno’s reach.

Conoscenze

GRC

SOC 2

NIST CSF

Security Audit

Automation

Cloud Security

AI tools

Strumenti

AWS

GCP

GRC platform

Descrizione del lavoro

Suno is seeking a Staff Security GRC Analyst to build Suno's security compliance program from the ground up. You'll report to the CISO and own the control framework that ties SOC 2 and NIST CSF together, working with AppSec and InfraSec to ensure controls are effective.

You’ll automate evidence collection with scripts and AI, run SOC 2 readiness end to end, and partner with Legal and Product to answer customer security questionnaires.