Senior GRC Security Analyst: Third-Party Risk & Compliance

Lucid; Raleigh (NC); Hybrid; USD 110,000 - 140,000; Full time

Job summary

Lucid Software is seeking a Security Analyst to protect corporate assets, web applications, and employees. You will drive day-to-day GRC operations, third-party risk assessments, and support audits for SOC 2 and ISO 27001 while advocating a culture of security awareness.

You will partner with Legal, Engineering, IT, Finance, and HR to implement practical security controls, measure risk, and ensure regulatory compliance across the company.

Qualifications

• 3+ years of experience with third party risk management, GRC, customer due diligence, etc.
• Understanding of security frameworks and principles (NIST 800-53, ISO 27001, SOC 2, etc).
• Excellent verbal and written skills; clear documentation.
• Strong interpersonal skills across non-technical and technical teams.

Responsibilities

• Conduct third-party vendor risk assessments and internal risk evaluations; identify vulnerabilities and control gaps.
• Respond to vendor security questionnaires and support internal teams in security questions.
• Track and collect evidence for SOC 2 and ISO 27001 audits.
• Identify threats and collaborate to develop practical security solutions.
• Coordinate and deliver security awareness training programs for employees.
• Ensure compliance with external regulations affecting the company.
• Collect and maintain security and compliance metrics for dashboards.
• Partner with Legal, Engineering, IT, Finance, and HR to ensure security policies are understood.
• Identify inefficiencies and help design smoother security workflows.

Skills

Vendor risk assessment

GRC

Security concepts

Documentation

Interpersonal skills

Education

Bachelor's in information security or related

Tools

NIST 800-53

ISO 27001

SOC 2

Cloud platforms (AWS/GCP/Azure)

Job description

Lucid Software is seeking a Security Analyst to protect corporate assets, web applications, and employees. You will drive day-to-day GRC operations, third-party risk assessments, and support audits for SOC 2 and ISO 27001 while advocating a culture of security awareness.

You will partner with Legal, Engineering, IT, Finance, and HR to implement practical security controls, measure risk, and ensure regulatory compliance across the company.