Crusoe
Senior GRC Analyst
San Francisco, CA - US. Posted 23 days ago
The role
The Senior GRC Analyst will own and drive the day-to-day execution of the Governance, Risk, and Compliance program. This role manages core compliance operations across security and privacy frameworks and provides SOX expertise for IT controls.
What you will do
- Support the design, operation, and testing of IT general controls for SOX audit requirements.
- Identify SOX control gaps and partner with stakeholders to drive remediation plans.
- Collect and deliver audit evidence for SOX, SOC 2, ISO 27001, HIPAA, and other frameworks.
- Act as a point of contact for internal and external auditors.
- Coordinate and complete User Access Reviews across in-scope systems.
- Maintain and update organizational security policies and standards.
- Conduct third-party security assessments and review vendor contracts.
- Respond to customer security questionnaires and due diligence requests.
- Drive enhancements within the GRC tool.
- Identify opportunities to automate repetitive GRC workflows using AI and LLM-based tools.
Required qualifications
- 5–7 years of experience in GRC, information security, IT audit, or a related compliance role.
- Demonstrated ownership of end-to-end audit cycles.
- Practical knowledge of compliance frameworks such as SOC 2, ISO 27001, HIPAA, and NIST CSF.
- Solid understanding of SOX 404 audit requirements and IT general controls.
- Hands-on experience identifying control gaps and working with stakeholders to remediate them.
- Hands-on experience with GRC platforms.
- Experience conducting user access reviews, vendor risk assessments, and internal audits.
- Familiarity with responding to customer security questionnaires and managing trust center content.
- Comfort using AI tools (e.g., Gemini, Claude, Copilot).
- Strong written and verbal communication skills.
- Highly organized, self-directed, and able to manage multiple priorities and stakeholders independently.
- Detail-oriented with strong follow-through on recurring operational tasks.
Nice to have
- Certifications such as CISA, CRISC, CISSP, Security+, or ISO 27001 Lead Auditor
- Background from public accounting and/or high-growth technology companies navigating SOX compliance
- Experience with cloud environments (GCP preferred; AWS/Azure exposure helpful)
- Familiarity with financial systems (ERP, billing, or revenue recognition platforms)
- Experience with policy management and security awareness training platforms
- Familiarity with AI risk assessment frameworks and emerging AI governance practices
- Experience mentoring junior analysts or leading cross-functional compliance initiatives
- Vanta preferred
Benefits
- Competitive compensation and equity packages
- Restricted Stock Units
- Paid time off, paid holidays & leave of absence programs
- Comprehensive health, dental & vision insurance
- Employer contributions to HSA account
- Paid parental leave
- Paid life insurance, short-term and long-term disability
- Professional development & tuition reimbursement
- Mental health & wellness support
- Commuter benefits (parking & transit)
- Cell phone stipend
- 401(k) Retirement plan with company match up to 4% of salary
About the company
Crusoe is a vertically integrated AI infrastructure company that owns and operates each layer of the stack to power AI workloads. The company uses an energy-first approach to solve the demand for AI compute.