Cybersecurity GRC Analyst

Semperis•Austin, TX

About The Position

The Cybersecurity GRC Analyst supports Semperis’s governance, risk, compliance, audit, and customer trust work. The role supports certification and audit programs that help customers adopt Semperis cloud products, and owns the annual security awareness training campaign. It is hands-on and learning-focused, with well-defined initial assignments and increasing responsibility as the analyst learns the company’s programs. The analyst works with experienced teammates who review work and provide guidance, and uses AI and GRC tools, including Vanta. During the first year, the analyst gathers evidence for SOC 2 and ISO 27001 audits, responds to customer security questionnaires, coordinates policy updates, and supports vendor risk and FedRAMP work. Responsibilities also include tracking training completion and exceptions, maintaining audit-ready records, supporting the cyber risk register, and improving GRC processes and automation.

Requirements

One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
At least 6 months of experience in a GRC role.
Strong organization, attention to detail, and follow-through on deadlines.
Clear written and verbal communication skills.
Working knowledge of Microsoft 365 and Excel.
Comfort using AI-assisted tools.

Nice To Haves

2 to 3 years of work experience in IT, cybersecurity, or GRC.
Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee.
Experience with a modern GRC platform such as Vanta.
Experience answering customer security questionnaires.
Experience at a SaaS, cloud, or cybersecurity company.

Responsibilities

Follow up on overdue security training and lead the annual Security and Compliance Training campaign.
Coordinate with People Operations and Legal on the training curriculum, set up enrollments in the training platform, track completion weekly, and escalate overdue training.
Handle training exceptions, maintain training records as audit evidence, and gather feedback to improve future campaigns.
Answer customer security questionnaires, beginning with simpler requests and escalating complex requests to senior teammates.
Check questionnaire answers for accuracy, verify requestors are under NDA before sharing information, and help maintain the answer library and Trust Center content.
Learn the FedRAMP program and support the FedRAMP ISSO as needed.
Gather and organize SOC 2 and ISO 27001 audit evidence, confirm it meets requests, and prepare it for review before submission to auditors.
Coordinate security policy reviews and approvals, publish approved policies, and maintain version history and change records.
Recommend improvements to team processes, status reporting, and work priorities.
Track annual recertification of critical vendors and send information requests to vendors.
Provide administrative support for the cyber risk register, including intake of new risk information.
Use Vanta and help identify opportunities to automate manual tasks and evidence collection.