Senior Security GRC Analyst — SOC 2/PCI, Equity Eligible

Turo; San Francisco (CA); On-site; USD 131,000 - 164,000; Full time

Benefits offered by this job

Competitive salary

Equity

Benefits

Learning & Development stipend

Travel credit

Cell phone and internet stipend

Time off and parental leave

Job summary

Turo, the world's largest car sharing marketplace, seeks a Senior Security GRC Analyst to own SOC 2 Type II and PCI DSS audit readiness. You will coordinate evidence with engineering, IT, finance, and legal, maintain the control framework, and drive remediation across audit cycles.

You will report to Enterprise Security, partnering with multiple teams while advancing security governance, policy, and automation to keep audit readiness year-round.

Qualifications

• 5+ years in security compliance, GRC, or IT audit, with hands-on audit program experience.
• Direct ownership of at least one full SOC 2 Type II and/or PCI DSS audit cycle.
• Strong cross-team coordination across Engineering, IT, Finance, and Legal.
• Familiarity with cloud security controls and data-protection obligations.

Responsibilities

• Own compliance calendar and drive SOC 2 Type II and PCI DSS audit readiness end-to-end.
• Coordinate evidence collection with engineering, IT, finance and business teams.
• Maintain control framework mapping across SOC 2 and PCI DSS and automate where possible.
• Lead testing, document results, and manage remediation of findings.

Skills

SOC 2 Type II

PCI DSS

Security compliance

Audits coordination

Cloud security AWS

Communication skills

Independent work

Education

Bachelor's degree in Computer Science or Information Security

Tools

GRC tools (Vanta, Drata, ZenGRC)

Job description

Turo, the world's largest car sharing marketplace, seeks a Senior Security GRC Analyst to own SOC 2 Type II and PCI DSS audit readiness. You will coordinate evidence with engineering, IT, finance, and legal, maintain the control framework, and drive remediation across audit cycles.

You will report to Enterprise Security, partnering with multiple teams while advancing security governance, policy, and automation to keep audit readiness year-round.