Cybersecurity GRC Analyst

About The Role

• This is a hands-on, learning-focused role supporting the GRC team across governance, risk, compliance, and customer trust.

Key Responsibilities

Security Awareness Training

• Follow up on overdue security training.
• Lead the annual Security and Compliance Training campaign: work with People Operations and Legal on the curriculum, set up enrollments in the training platform, track completion weekly, and escalate overdue training.
• Handle training exceptions.
• Keep training records ready as audit evidence.
• Gather feedback to improve next year's campaign.

Customer Trust

• Answer customer security questionnaires, starting with simpler requests.
• Escalate complex requests to senior teammates.
• Check answers for accuracy.
• Confirm requestors are under NDA before sharing information.
• Help maintain our answer library and Trust Center content.

Audit and Compliance Support

• Learn our FedRAMP program and support the FedRAMP ISSO as needed.
• Gather and organize evidence for SOC 2 and ISO 27001 audits.
• Confirm evidence meets each request and prepare it for review before it goes to auditors.

Governance and Risk Support

• Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records.
• Recommend improvements to team processes, status reporting, and work priorities.
• Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors.
• Provide administrative support for the cyber risk register, including intake of new risk information.
• Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection.

Requirements & Tech Stack

Required

• One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
• At least 6 months of experience in a GRC role.
• Strong organization, attention to detail, and follow-through on deadlines.
• Clear written and verbal communication skills.
• Working knowledge of Microsoft 365 and Excel.
• Comfort using AI-assisted tools.

Preferred Qualifications

• 2 to 3 years of work experience in IT, cybersecurity, or GRC.
• Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee.
• Experience with a modern GRC platform such as Vanta.
• Experience answering customer security questionnaires.
• Experience at a SaaS, cloud, or cybersecurity company.

Success Measures (First Year)

• Assignments are completed correctly and on time, with good judgment about when to ask for help.
• Overdue training is followed up and the annual training campaign is delivered on schedule.
• Ownership of customer security questionnaires is shared within the first few months.
• Audit evidence for SOC 2 and ISO 27001 is complete and on time.