GRC (Governance, Risk, and Compliance) Analyst

YipitData (Alternative)

1d•Remote

About The Position

YipitData is seeking a GRC Analyst to help answer critical questions about the effectiveness of security controls, identify and manage risks, and ensure compliance as the company's products, technology, and AI usage evolve. The role involves working across audits, risk assessments, control testing, vendor reviews, customer questionnaires, and policy management. The analyst will collaborate with various teams including Security, IT, Engineering, Legal, Finance, and People to understand business operations, identify areas for improvement, and drive GRC initiatives to completion. This is a remote-friendly opportunity within the US, with flexible work hours, though most employees align with East Coast hours. The company emphasizes a proactive approach, valuing curiosity, thoughtfulness, and organization over simply uploading documents to platforms.

Requirements

Ability to operate in an environment that is constantly changing: where not every process is perfect or every answer is immediately available
Experience in security, compliance, risk, audit, privacy, vendor risk, or another field that taught you how to evaluate whether expectations are being met
Hands-on SOC 2 experience, including supporting Type I or Type II audits, testing controls, validating evidence, coordinating with auditors, and tracking remediation through completion.
Understanding that evidence is only useful if it actually proves the control
Ability to connect a policy or framework requirement to what people and systems are doing in the real world
Familiarity with SOC 2, NIST CSF, or similar security and compliance frameworks
Strong writing skills to make complicated requirements clear for those not familiar with security frameworks
Ability to notice inconsistencies, missing information, and answers that do not quite add up
Ability to keep multiple workstreams organized, meet deadlines, and follow through
Good communication skills with both technical and non-technical teams and ability to explain why a requirement matters
Takes ownership, uses good judgment, and knows when to work independently versus when to escalate
Interest in figuring out how traditional governance needs to evolve for AI and other emerging technologies

Responsibilities

Take ownership of GRC workstreams and drive them from the initial request through evidence collection, testing, remediation, and completion
Help keep YipitData audit-ready throughout the year
Test security controls and determine whether they are actually working, rather than simply confirming that a document exists
Conduct risk assessments, identify meaningful gaps, and help teams develop remediation plans that are realistic and effective
Map controls across SOC 2 and other frameworks so one strong control can satisfy multiple requirements
Coordinate recurring work such as access reviews, control testing, policy reviews, risk updates, and audit evidence requests
Review vendors and help determine whether their security practices meet YipitData’s expectations
Support customer security questionnaires by finding the right information, validating it, and making sure our answers are accurate and consistent
Translate compliance requirements into clear actions for teams that do not live and breathe GRC
Draft and maintain policies, standards, control narratives, risk records, metrics, and other program documentation
Track findings and remediation commitments, follow up with owners, and keep issues from quietly sitting open forever
Look for ways to simplify and automate repetitive GRC work so the program can scale with the business
Help us think through governance for emerging technologies, including AI products, agents, and new ways of handling data