Cybersecurity GRC Analyst

About the Role

Our GRC team runs the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers adopt our cloud products with confidence. As our Cybersecurity GRC Analyst, you'll support the team across governance, risk, compliance, and customer trust work, and you'll own our annual security awareness training campaign. This is a hands-on, learning-focused role: you'll start with well-defined tasks and take on more complex work as you learn our programs. You'll get exposure to every part of GRC.

Key Responsibilities

Security Awareness Training

• Follow up on overdue security training, then lead the annual Security and Compliance Training campaign.
• Work with People Operations and Legal on the curriculum.
• Set up enrollments in the training platform.
• Track completion weekly and escalate overdue training.
• Handle training exceptions.
• Keep training records ready as audit evidence.
• Gather feedback to improve next year's campaign.

Customer Trust

• Answer customer security questionnaires, starting with simpler requests and taking on more within your first few months.
• Escalate complex requests to senior teammates.
• Check answers for accuracy.
• Confirm requestors are under NDA before sharing information.
• Help maintain our answer library and Trust Center content.

Audit and Compliance Support

• Learn our FedRAMP program and support the FedRAMP ISSO as needed.
• Gather and organize evidence for SOC 2 and ISO 27001 audits.
• Confirm evidence meets each request and prepare it for review before it goes to auditors.

Governance and Risk Support

• Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records.
• Recommend improvements to team processes, status reporting, and work priorities.
• Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors.
• Provide administrative support for the cyber risk register, including intake of new risk information.
• Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection.

Requirements & Tech Stack

Required

• One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
• At least 6 months of experience in a GRC role.
• Strong organization, attention to detail, and follow-through on deadlines.
• Clear written and verbal communication skills.
• Working knowledge of Microsoft 365 and Excel.
• Comfort using AI-assisted tools.

Preferred Qualifications

• 2 to 3 years of work experience in IT, cybersecurity, or GRC.
• Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee.
• Experience with a modern GRC platform such as Vanta.
• Experience answering customer security questionnaires.
• Experience at a SaaS, cloud, or cybersecurity company.