Senior GRC Analyst

The role

The Senior GRC Analyst will own SOC/ISO/HIPAA audits, customer security questionnaires, and the upkeep of security policies and standards. You will drive remediation follow through with engineering and support FedRAMP work. The role involves running programs independently and providing backup for vendor risk and risk exceptions.

What you will do

• Execute SOC2 Type II and ISO 27001 audits including fieldwork and reporting
• Cover HIPAA Audits as part of SOC and ISO work
• Support FedRAMP program by researching requirements and gathering evidence
• Perform internal audit, assurance testing, and due diligence work
• Own customer, partner, and prospect security questionnaires
• Build and maintain a reusable answer library
• Drive remediation dates with Engineering for non-FedRAMP audit findings
• Maintain information security policies, standards, and procedures
• Back up teammates on vendor risk assessments and risk exception reviews
• Help define and report KPIs and KRIs

Required qualifications

• 5+ years of experience in GRC, information security risk, compliance, or IT audit
• Experience at a SaaS company
• A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA
• SOC 2 Type II and ISO 27001 audit and attestation experience
• Clear written and verbal communication
• Ability to explain technical control details to engineers, business owners, and customers
• Track record of getting results through influence with engineers and stakeholders

Nice to have

• Hands-on experience in at least four areas: security policy and standards; GRC operations; third party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk regist
• Experience with FedRAMP, NIST 800-53, or other government compliance frameworks
• Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow
• Experience automating control monitoring and evidence collection
• Experience answering customer security questionnaires at scale with AI-assisted tools
• GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries
• Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF
• Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans

Before you apply

• U.S. citizenship

About the company

Semperis is a cybersecurity company recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000. The company focuses on creating an employee experience rooted in purpose, growth, and balance.