Governance, Risk, and Compliance (GRC) Analyst

Vibes•Chicago, IL

1d•$75,000 - $80,000

About The Position

Vibes is hiring a GRC Analyst to collect and organize control evidence, test controls, support audits, and help customers and auditors understand how the company protects data. The analyst will join a small, fast-moving GRC and vendor management team and work closely with vendor operations, which gathers application and vendor evidence for validation. Many processes are still being built, so the role will help shape Vibes’ compliance practices. The position reports to the Senior Program Manager. The role covers audit evidence and coordination, control testing and findings, vendor risk reviews, customer security questionnaires and RFP responses, and policy lifecycle administration. Success means keeping evidence current, verifying that findings are closed, improving the accuracy and timeliness of customer responses, and serving as a helpful partner to control owners.

Requirements

At least 2 years in audit, compliance, GRC, or equivalent.
Working knowledge of a recognized control framework and how evidence maps to it.
Experience handling customer security questionnaires and/or RFP security sections end to end.
Experience building or maintaining a questionnaire answer library.
Comfort using AI tools to draft compliance answers, with review steps.
Detail-oriented, able to assess whether evidence answers the control question, and comfortable requesting evidence from control owners.
Able to communicate concerns clearly and kindly, escalate when needed, identify problems early, and recommend solutions.
Self-directed and adaptable, able to manage multiple workstreams and shifting priorities.
Honest, reliable, and committed to treating people well, including customers.

Nice To Haves

Control testing experience, including selecting samples, assessing whether evidence proves a control, and documenting gaps.
Basic Smartsheet experience.
Compliance platform experience.

Responsibilities

Collect and organize control evidence continuously.
Help coordinate internal and external audits and serve as the day-to-day contact for auditors.
Prepare regular control and audit status reports for leadership.
Test whether controls work as designed and work with control owners to close gaps.
Maintain the finding registry and verify findings are closed before marking them complete.
Run quarterly user access reviews, sample offboarding, and reconcile app and laptop inventories against SSO, billing, and purchases.
Review vendor risk assessments and recommend approval or follow-up before contracts are signed or renewed.
Draft responses to customer security questionnaires and compliance sections of RFPs, flagging answers that need review.
Use and help improve the AI tool that pre-fills questionnaire responses, and keep the process behind it current.
Administer the policy lifecycle, including review dates, version control, and attestation tracking.