Cybersecurity GRC Analyst

Semperis•Addison, TX

About The Position

Semperis is hiring a Cybersecurity GRC Analyst to support governance, risk, compliance, and customer trust work. The role includes owning the annual security awareness training campaign and supporting the company’s certification and audit programs, which help customers adopt its cloud products with confidence. This is a hands-on, learning-focused position in a small team. The analyst will begin with well-defined tasks and take on more complex work over time, with experienced teammates reviewing work and providing support. The role uses AI and GRC tools, including Vanta. During the first year, the analyst will gather evidence for SOC 2 and ISO 27001 audits, respond to customer security questionnaires, coordinate policy updates, and support vendor risk and FedRAMP work. Success requires strong organization, responsiveness, collaboration, and helping control owners provide the information needed by auditors and customers.

Requirements

Hold a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
At least 6 months of experience in a GRC role.
Strong organization, attention to detail, and follow-through on deadlines.
Clear written and verbal communication skills.
Working knowledge of Microsoft 365 and Excel.
Comfort using AI-assisted tools.

Nice To Haves

2 to 3 years of work experience in IT, cybersecurity, or GRC.
Exposure to SOC 2, ISO 27001, or FedRAMP audits in a supporting role or as an auditee.
Experience with a modern GRC platform such as Vanta.
Experience answering customer security questionnaires.
Experience at a SaaS, cloud, or cybersecurity company.

Responsibilities

Follow up on overdue security training and lead the annual Security and Compliance Training campaign.
Coordinate with People Operations and Legal on the training curriculum, set up training enrollments, track completion weekly, and escalate overdue training.
Handle training exceptions, maintain training records as audit evidence, and gather feedback to improve future campaigns.
Answer customer security questionnaires, starting with simpler requests and escalating complex requests to senior teammates.
Check questionnaire answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain the answer library and Trust Center content.
Learn the FedRAMP program and support the FedRAMP ISSO as needed.
Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets audit requests, and prepare it for review before submission to auditors.
Coordinate security policy updates by routing policies for review and approval, publishing approved versions, and maintaining version history and change records.
Recommend improvements to team processes, status reporting, and work priorities.
Track annual recertification of critical vendors and send information requests to vendors.
Provide administrative support for the cyber risk register, including intake of new risk information.
Use the GRC platform, Vanta, and identify ways to automate manual tasks and evidence collection.