Cybersecurity GRC Analyst

Semperis•Hoboken, NJ

About The Position

Semperis is hiring a Cybersecurity GRC Analyst to support governance, risk, compliance, audits, and customer trust. The role contributes to certification and audit programs that help enterprise, regulated-industry, and government customers adopt Semperis cloud products. It is a hands-on, learning-focused position, with well-defined tasks initially and opportunities to take on more complex work as experience grows. Experienced teammates review work and provide support, and the team uses AI and GRC tools, including Vanta. During the first year, the analyst will gather evidence for SOC 2 and ISO 27001 audits, respond to customer security questionnaires, coordinate policy updates, and support vendor risk and FedRAMP activities. The analyst will also own the annual security awareness training campaign and help improve processes, status reporting, and work priorities. No sponsorship will be provided. Candidates must be eligible to work in the country in which they apply. Where a required location is specified, the role follows a hybrid model of up to three days per week in the office and the remaining days remotely.

Requirements

At least one of the following: CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
At least 6 months of experience in a GRC role.
Strong organization, attention to detail, and follow-through on deadlines.
Clear written and verbal communication skills.
Working knowledge of Microsoft 365 and Excel.
Comfort using AI-assisted tools.

Nice To Haves

2 to 3 years of work experience in IT, cybersecurity, or GRC.
Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee.
Experience with a modern GRC platform such as Vanta.
Experience answering customer security questionnaires.
Experience at a SaaS, cloud, or cybersecurity company.

Responsibilities

Follow up on overdue security training and lead the annual Security and Compliance Training campaign in coordination with People Operations and Legal.
Set up training enrollments, track completion weekly, and escalate overdue training.
Handle training exceptions, maintain training records as audit evidence, and gather feedback to improve future campaigns.
Answer customer security questionnaires, beginning with simpler requests and escalating complex requests to senior teammates.
Check questionnaire answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain the answer library and Trust Center content.
Learn the FedRAMP program and support the FedRAMP ISSO as needed.
Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets each request, and prepare it for review before submission to auditors.
Coordinate security policy reviews and approvals, publish approved policies, and maintain version histories and change records.
Recommend improvements to team processes, status reporting, and work priorities.
Track annual recertification of critical vendors and send information requests to vendors.
Provide administrative support for the cyber risk register, including intake of new risk information.
Use the Vanta GRC platform and identify opportunities to automate manual tasks and evidence collection.