Senior GRC & Security Assurance Lead

Openkrill; United States; Hybrid; USD 120,000 - 150,000; Full time

Benefits offered by this job

Flexible remote & hybrid work options

Learning & development opportunities

Generous PTO & holidays

Mental health benefits

Volunteer days (MAD Days)

Job summary

Shift is seeking an experienced Senior GRC Analyst to shape and maintain our security and privacy program within the Information Security department. You will own governance, risk assessment, and third‑party assurance, supporting customer due diligence and contract reviews while helping ensure regulatory compliance across our SaaS platform.

The role reports to the GRC Lead and requires strong stakeholder management, knowledge of GDPR/HIPAA, and hands-on experience with modern GRC tooling such as

Qualifications

• Minimum 7+ years in GRC, IT Audit, Security Assurance or Information Security.
• Experience delivering audits and certifications end-to-end in regulated industries such as financial services or healthcare.
• Hands-on familiarity with modern GRC tools and security/privacy frameworks.

Responsibilities

• Lead governance, policy management, and privacy policy development aligned with GDPR/HIPAA and global regs.
• Develop and maintain security assurance plans; improve third‑party assurance and DPIAs for new products.
• Coordinate internal/external audits (ISO 27001, SOC 2 Type II) and manage remediation of findings.

Skills

GRC expertise

Stakeholder management

Project management

Communication skills

Education

Bachelor’s Degree in a relevant field

Tools

Drata

Job description

Shift is seeking an experienced Senior GRC Analyst to shape and maintain our security and privacy program within the Information Security department. You will own governance, risk assessment, and third‑party assurance, supporting customer due diligence and contract reviews while helping ensure regulatory compliance across our SaaS platform.

The role reports to the GRC Lead and requires strong stakeholder management, knowledge of GDPR/HIPAA, and hands-on experience with modern GRC tooling such as