Senior GRC Analyst

The role

The Senior GRC Analyst will own SOC/ISO/HIPAA audits, customer security questionnaires, and the upkeep of security policies and standards. You will also drive remediation follow through for audit findings and support FedRAMP work.

What you will do

• Execute SOC2 Type II and ISO 27001 audits including fieldwork and reporting.
• Cover HIPAA Audits as part of SOC and ISO work.
• Support FedRAMP program by researching requirements and gathering evidence.
• Perform internal audit, assurance testing, and due diligence work.
• Own customer, partner, and prospect security questionnaires and due diligence requests.
• Build and maintain a reusable answer library.
• Drive remediation dates with Engineering for non-FedRAMP audit findings.
• Maintain information security policies, standards, and procedures.
• Back up teammates on vendor risk assessments and risk exception reviews.
• Help define and report KPIs and KRIs and support the cyber risk register.

Required qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
• A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA.
• SOC 2 Type II and ISO 27001 audit and attestation experience.
• Clear written and verbal communication.
• Ability to explain technical control details to engineers, business owners, and customers.
• Track record of getting results through influence with engineers and other stakeholders.
• U.S. citizenship.

Nice to have

• Hands-on experience in at least four areas: security policy and standards; GRC operations; third party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk regist
• Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
• Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
• Experience automating control monitoring and evidence collection (compliance as code).
• Experience answering customer security questionnaires at scale with AI-assisted tools.
• GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
• Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
• Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.

About the company

Semperis is a cybersecurity company recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000. The company focuses on creating an employee experience rooted in purpose, growth, and balance.