Governance, Risk, and Compliance (GRC) Analyst

Vibes•Chicago, IL

About The Position

Vibes is hiring a GRC Analyst to support audits, control testing, vendor risk reviews, customer security questionnaires, and policy administration. The role is part of a small, fast-moving GRC and vendor management team and works closely with vendor operations, which gathers evidence on applications and vendors for the analyst to validate. Many processes are still being built, giving the analyst an opportunity to help shape Vibes’ compliance program. The position reports to the Senior Program Manager. The analyst will keep control evidence organized and current, coordinate audits, test controls, track findings through verified closure, and prepare status reports for leadership. The role also includes quarterly user access reviews, sampling offboarding, reconciling application and laptop inventories against SSO, billing, and purchasing records, reviewing vendor risk assessments, drafting customer questionnaire and RFP responses, helping improve an AI-assisted questionnaire process, and administering policy reviews, version control, and attestations. Vibes is looking for someone who is detail-oriented, objective, reliable, self-directed, adaptable, and comfortable working with control owners across the business. The analyst should be able to raise concerns constructively, identify problems early, and recommend solutions while supporting the business and maintaining accurate assessments of controls.

Requirements

At least 2 years of experience in audit, compliance, GRC, or equivalent.
Working knowledge of a recognized control framework and how evidence maps to it.
Experience handling customer security questionnaires and/or security sections of RFPs end to end.
Experience building or maintaining a questionnaire answer library.
Comfort using AI tools to draft compliance answers while applying review steps.
Detail-oriented, able to assess whether evidence answers the question, and comfortable requesting evidence from control owners across the business.
Able to communicate concerns clearly and kindly, escalate when needed, manage multiple workstreams, and adapt when priorities shift.

Nice To Haves

Control testing experience, including selecting samples, assessing whether evidence proves a control, and documenting gaps.
Basic Smartsheet experience.
Compliance platform experience.

Responsibilities

Collect and organize control evidence on an ongoing basis.
Coordinate internal and external audits and serve as the day-to-day contact for auditors.
Prepare regular control and audit status reports for leadership.
Test whether controls operate as designed and work with control owners to close gaps.
Maintain the finding registry and verify findings are closed before marking them complete.
Run quarterly user access reviews, sample offboarding, and reconcile application and laptop inventories against SSO, billing, and purchases.
Review vendor risk assessments and recommend approval or follow-up before contracts are signed or renewed.
Draft responses to customer security questionnaires and compliance sections of RFPs, flagging answers that need review.
Use and help improve the AI tool that pre-fills questionnaire responses, and keep the process behind it current.
Administer the policy lifecycle, including review dates, version control, and attestation tracking.