Senior Security GRC Analyst

Turo Inc.; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Competitive salary and equity

Medical, dental, vision insurance

Retirement match

Learning & Development stipend

Travel credit

Cell phone and internet stipend

Paid time off and holidays

Office perks for hybrid/onsite

Job summary

Turo Inc. is seeking a Senior Security GRC Analyst to lead security compliance programs within Enterprise Security.

You will own SOC 2 Type II and PCI DSS audit readiness, coordinating evidence collection across Engineering, IT, Finance, Legal, and business control owners to stay audit-ready year-round. You will manage audit interactions with external auditors, refine control frameworks, and drive continuous improvement in governance, risk, and compliance processes across a fast-moving tech

Qualifications

• 5+ years in security compliance, GRC, or IT audit, with hands-on audit program experience.
• Direct ownership of at least one full SOC 2 Type II and/or PCI DSS audit cycle.
• Coordinate evidence collection across Engineering, IT, Finance, and business teams.
• Knowledge of cloud security (AWS), IAM, and encryption frameworks.
• Strong written and verbal communication translating technical compliance to non-security stakeholders.

Responsibilities

• Own SOC 2 Type II and PCI DSS audit readiness, including scoping and control mapping.
• Coordinate evidence collection and remediation with cross-functional teams.
• Serve as liaison with external auditors and assessors.
• Maintain control framework mapping across standards and automate where possible.
• Lead testing activities and preserve evidence repositories.

Skills

Security GRC

SOC 2 Type II

PCI DSS

Audit coordination

Cloud security (AWS)

IAM

Encryption

Communication

Independent work

GRC tooling

Education

Bachelor's degree in Computer Science / Information Security / Information Assurance

Tools

Vanta

Drata

ZenGRC

Job description

About the team

Turo is searching for a highly motivated and versatile Senior Security GRC Analyst under the Enterprise Security team to lead security compliance programs as a senior individual contributor. This role carries primary ownership of SOC 2 Type II and PCI DSS audit readiness and coordination, and serves as the connective tissue between Engineering, IT, Finance, Legal, and business control owners. You will drive complex security compliance workstreams with limited oversight, exercising strong judgment and cross-functional influence to keep Turo audit-ready year-round.

Security Compliance & Audit Readiness

• Own the compliance calendar and drive end-to-end audit readiness for SOC 2 Type II and PCI DSS, including scoping, control mapping, and continuous readiness between audit cycles.
• Coordinate evidence collection across Engineering, IT, Finance, and business teams; track control owners and close gaps ahead of audit windows.
• Serve as the primary day-to-day liaison with external auditors and assessors to manage requests, facilitate walkthroughs, and coordinate remediation of findings.
• Maintain and evolve the common control framework: map controls across SOC 2, PCI DSS, and other applicable standards; identify and eliminate redundant testing where possible.
• Lead compliance testing activities, document results, and maintain evidence repositories that support both internal review and external audit.

Findings, Remediation & Exception Management

• Track open audit findings and remediation commitments; provide status reporting to Security leadership and relevant stakeholders.
• Manage the security exception process and document risk acceptances, obtain appropriate approvals, and monitor exceptions through expiration or remediation.
• Identify control gaps proactively and partner with control owners to design and implement compensating or corrective controls.

Policy & Governance

• Develop, maintain, and enforce security policies, standards, and procedures; keep them current with regulatory change and evolving business needs.
• Partner with Legal on data-privacy obligations, subprocessor reviews, and breach-notification readiness.
• Establish and report on compliance metrics - audit readiness scores, open findings aging, exception inventory, and cycle time - to drive accountability and visibility.
• Identify and implement process and automation improvements that increase throughput and reduce manual effort across compliance workflows.

Your Profile

• 5+ years in security compliance, GRC, or IT audit, with hands-on experience running security audit programs from start to finish.
• Direct ownership of at least one full audit cycle under SOC 2 Type II and/or PCI DSS - from scoping through final report.
• Demonstrated ability to coordinate evidence collection and remediation across multiple engineering and business teams with limited oversight.
• Working knowledge of cloud security (AWS), IAM, and encryption frameworks - sufficient to assess controls and evaluate evidence critically.
• Strong written and verbal communication skills; able to translate technical compliance requirements into clear guidance for non-security stakeholders.
• Comfort operating independently in an ambiguous, fast-moving environment, managing competing deadlines without close supervision.
• Bachelor's degree in Computer Science, Information Security, Information Assurance or equivalent practical experience.
• Relevant certification: CISA, CISM, CISSP, or equivalent security certification.
• Experience scaling a security compliance program through initial certification and into annual renewal cycles.
• Familiarity with GRC tooling (e.g., Vanta, Drata, ZenGRC) and security-automation platforms.
• Experience in a regulated or high-trust industry - fintech, marketplace, or SaaS handling sensitive personal or financial data.

For this role, the target base salary range in San Francisco is $131,000-$164,000 annually. This role is also eligible for equity and benefits.

Benefits

• Competitive salary, equity, benefits, and perks for all full-time employees
• Employer-paid medical, dental, and vision insurance (Country specific)
• Retirement employer match
• Learning & Development stipend to invest in your professional development
• Turo host matching program
• Turo travel credit
• Cell phone and internet stipend
• Paid time off to relax and recharge
• Paid holidays, volunteer time off, and parental leave
• For those who are in the office full-time or hybrid we have in-office lunch, office snacks, and fun activities

We are committed to building a diverse team. If you are from a background that's underrepresented in tech, we'd love to meet you.

Aside from an award winning work environment and the opportunity to be part of the world’s largest car sharing marketplace, we are also growing the team quickly - join us! Even if you don't meet every qualification, we are looking for people with enthusiasm for what we do and we will consider you for this and other possibilities.

About Turo

Turo is the world’s largest car sharing marketplace where you can book the perfect car for wherever you’re going from a vibrant community of trusted hosts across the US, UK, Canada, Australia, and France. Whether you're flying in from afar or looking for a car down the street, searching for a rugged truck or something smooth and swanky, Turo puts you in the driver's seat of an extraordinary selection of cars shared by local hosts.

Discover Turo at https://turo.com, the App Store, and Google Play, and check out our blog, Field Notes. Read more about the Turo culture according to Turo CEO, Andre Haddad.

Turo is an Equal Opportunity Employer and a participant in the U.S. Federal E-Verify program. Women, minorities, individuals with disabilities and protected veterans are encouraged to apply. We welcome people of different backgrounds, experiences, abilities and perspectives. Turo will consider qualified applicants with criminal histories in a manner consistent with the San Francisco Fair Chance Ordinance, as applicable. We welcome candidates with physical, mental, and/or neurological disabilities. If you require assistance applying for an open position, or need accommodation during the recruiting process due to a disability, please submit a request to People Operations by emailing [e-mail].

Welcome to Turo Careers!