Senior Security GRC Analyst Audit-Ready & Compliance Lead

Turo Inc.; San Francisco (CA); Hybrid; USD 131,000 - 164,000; Full time

Benefits offered by this job

Competitive salary and equity

Medical, dental, vision insurance

Retirement match

Learning & Development stipend

Travel credit

Cell phone and internet stipend

Paid time off and holidays

Office perks for hybrid/onsite

Job summary

Turo Inc. is seeking a Senior Security GRC Analyst to lead security compliance programs within Enterprise Security.

You will own SOC 2 Type II and PCI DSS audit readiness, coordinating evidence collection across Engineering, IT, Finance, Legal, and business control owners to stay audit-ready year-round. You will manage audit interactions with external auditors, refine control frameworks, and drive continuous improvement in governance, risk, and compliance processes across a fast-moving tech

Qualifications

• 5+ years in security compliance, GRC, or IT audit, with hands-on audit program experience.
• Direct ownership of at least one full SOC 2 Type II and/or PCI DSS audit cycle.
• Coordinate evidence collection across Engineering, IT, Finance, and business teams.
• Knowledge of cloud security (AWS), IAM, and encryption frameworks.
• Strong written and verbal communication translating technical compliance to non-security stakeholders.

Responsibilities

• Own SOC 2 Type II and PCI DSS audit readiness, including scoping and control mapping.
• Coordinate evidence collection and remediation with cross-functional teams.
• Serve as liaison with external auditors and assessors.
• Maintain control framework mapping across standards and automate where possible.
• Lead testing activities and preserve evidence repositories.

Skills

Security GRC

SOC 2 Type II

PCI DSS

Audit coordination

Cloud security (AWS)

IAM

Encryption

Communication

Independent work

GRC tooling

Education

Bachelor's degree in Computer Science / Information Security / Information Assurance

Tools

Vanta

Drata

ZenGRC

Job description

Turo Inc. is seeking a Senior Security GRC Analyst to lead security compliance programs within Enterprise Security.

You will own SOC 2 Type II and PCI DSS audit readiness, coordinating evidence collection across Engineering, IT, Finance, Legal, and business control owners to stay audit-ready year-round. You will manage audit interactions with external auditors, refine control frameworks, and drive continuous improvement in governance, risk, and compliance processes across a fast-moving tech