Senior Security GRC Analyst — SOC 2 & NIST Focus

Suno; San Francisco (CA); On-site; USD 160,000 - 260,000; Full time

Job summary

Suno is seeking a Staff Security GRC Analyst to build Suno's security compliance program from the ground up. You will report to our CISO, own the control framework tying SOC 2 and NIST CSF together, and determine which controls exist and how they are validated.

You will automate evidence collection with scripts and AI, lead SOC 2 preparation end to end, run vendor security reviews, and collaborate with Legal and Product to answer customer security questionnaires, while informing leadership about

Qualifications

• 7–9 years in GRC, security compliance, or IT audit.
• Hands-on ownership of a security compliance program as its primary owner, ideally including taking a company through its first SOC 2.
• Deep working knowledge of SOC 2 and NIST CSF, including control mapping, audit mechanics, and evolving requirements.
• Enough technical fluency to read a cloud configuration, access setup, or pipeline and judge whether it enforces the control.
• Comfort building automation with scripts or AI tools.

Responsibilities

• Build and own Suno's security control framework, mapping controls to SOC 2, NIST CSF, and future frameworks.
• Lead SOC 2 preparation end to end, from gap assessments and readiness tracking to remediation with control owners and auditor.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools.
• Run vendor security reviews, keep security policies current, and answer customer security questionnaires with Product and Legal.
• Partner with the CISO to present leadership with an evidence-backed view of security posture and lay the foundations of GRC.

Skills

GRC experience

SOC 2 knowledge

NIST CSF knowledge

Automation scripting

Cloud configuration reading

Job description

Suno is seeking a Staff Security GRC Analyst to build Suno's security compliance program from the ground up. You will report to our CISO, own the control framework tying SOC 2 and NIST CSF together, and determine which controls exist and how they are validated.

You will automate evidence collection with scripts and AI, lead SOC 2 preparation end to end, run vendor security reviews, and collaborate with Legal and Product to answer customer security questionnaires, while informing leadership about