Senior GRC & Security Risk Analyst — Remote

XBOW; United States; Remote; USD 120,000 - 190,000; Full time

Benefits offered by this job

Competitive stock options

Remote-first culture

Job summary

XBOW is seeking an Information Security Analyst, GRC, to scale security and trust as we grow. You will support customer reviews, contract reviews with legal, and vendor risk assessments while collaborating with IT, Security, Legal, Sales, and Customer teams.

You’ll work in a fast-moving, remote-first startup, helping mature risk programs, maintain risk registers, and drive compliance with SOC 2, ISO 27001, NIST, GDPR, and HIPAA.

Qualifications

• 7+ years in risk, compliance, security assurance, or related roles
• Hands-on experience in technical roles (Engineering, IT, or security)
• Experience completing or reviewing security questionnaires and risk assessments
• Familiar with SOC 2, ISO 27001, NIST, GDPR, HIPAA frameworks
• Experience with vendor/third-party risk assessments
• Strong written communication; highly organized and detail-oriented
• Comfortable in a fast-moving, remote-first startup
• Knowledge of AI tooling to improve productivity while managing risk

Responsibilities

• Handle technical security questionnaires, risk assessments, and due-diligence requests for customers and prospects
• Explain XBOW’s security controls, architecture, and compliance posture to Sales and Customer teams
• Assess and manage third-party/vendor security risk, including SaaS providers
• Investigate alerts to stay compliant with compliance programs using Vanta
• Maintain risk assessment frameworks, methodologies, and documentation
• Track remediation of risks with internal stakeholders
• Support audits, customer reviews, and internal assurance activities
• Coordinate risk management sessions and streamline processes as the company scales

Skills

Security communications

Organization

Remote work adaptability

AI tooling familiarity

Tools

Vanta

Job description

XBOW is seeking an Information Security Analyst, GRC, to scale security and trust as we grow. You will support customer reviews, contract reviews with legal, and vendor risk assessments while collaborating with IT, Security, Legal, Sales, and Customer teams.

You’ll work in a fast-moving, remote-first startup, helping mature risk programs, maintain risk registers, and drive compliance with SOC 2, ISO 27001, NIST, GDPR, and HIPAA.