Staff Security GRC Analyst

The role

You will build and own Suno's security control framework. You will lead SOC 2 preparation, automate evidence collection, and run vendor security reviews.

What you will do

• Build and own Suno's security control framework mapping to SOC 2 and NIST CSF.
• Lead SOC 2 preparation from gap assessments to remediation and external audit.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools.
• Run vendor security reviews.
• Keep security policies current.
• Answer customer security questionnaires alongside Product and Legal.
• Partner with the CISO to provide leadership and the board with a view of security posture.

Required qualifications

• 7–9 years in GRC, security compliance, or IT audit.
• Hands-on, end-to-end ownership of a security compliance program as its primary owner.
• Deep working knowledge of SOC 2 and NIST CSF.
• Technical fluency to read a cloud configuration, access setup, or pipeline.
• Comfort building automation with scripts or AI tools.

Nice to have

• Experience standing up continuous controls monitoring or automated evidence collection.
• Experience applying LLMs to assurance work.
• Experience with cloud environments such as AWS or GCP.
• Experience with a modern GRC platform.
• Certifications such as CISA, CISSP, or CRISC.

About the company

Suno is a consumer entertainment company and the leader in AI music. It is building a creative entertainment platform for making music.