GRC Analyst

FloQast•New York City, NY

1d•Hybrid

About The Position

FloQast is seeking a GRC Analyst to support management of compliance controls, organizational policies, procedures, and standards related to regulatory compliance and information security. The role works with stakeholders across departments to align workflows and develop a strong compliance program. The Compliance department reports to the General Counsel and oversees compliance with security and privacy frameworks including GDPR, CPRA, ISO 27001, ISO 27701, ISO 42001, SOC 1, and SOC 2. The position requires working in the office three days per week, subject to review and change based on team and business needs. Visa sponsorship is not available.

Requirements

3–5+ years of relevant experience.
Knowledge of and familiarity with at least one security, privacy, or compliance practice, such as SOC 1, SOC 2, ISO 27001, ISO 27701, ISO 42001, PCI, or HIPAA.
Understanding of information security and privacy fundamentals.
Confidence and willingness to ask questions and raise issues or concerns in a timely manner.
Strong organizational skills and attention to detail.
Collaborative, intellectually curious, and authentically friendly demeanor.
Builder mindset, comfort sharing ideas and trying new approaches, and focus on team and company goals.
Flexibility and adaptability in a high-growth, start-up environment.

Nice To Haves

Certification in CompTIA, CISSP, CISA, CISM, or a cloud platform such as AWS, Azure, or GCP is preferred.
Understanding of AI governance or experience leveraging AI tools to improve compliance and audit efficiency.
Familiarity with NIST, CIS, and other information security frameworks.
Experience working for a software development company.

Responsibilities

Manage the internal controls inventory as controls are added or changed.
Maintain accurate and up-to-date control owner, testing procedure, policy, and related information in the controls inventory.
Work with control owners to document and annually update process narratives for all controls.
Initiate, monitor, and follow up on monthly and quarterly control activities to ensure timely completion and appropriate audit evidence.
Advise and advocate for security and compliance across the company, fostering a risk-aware culture.
Facilitate the development and maintenance of policies, standards, processes, and guidelines, including drafting updates, obtaining approvals, and reporting changes in policy review meetings.
Support annual internal and external ISO 27001, ISO 27701, ISO 42001, SOC 1, SOC 2, and similar audits by scheduling interviews, requesting and reviewing evidence, following up with control owners, and coordinating follow-up requests.
Aggregate identified internal control issues, perform root cause analysis, and collaborate on remediation efforts.
Serve as a compliance best-practices point of contact for stakeholders across the company.
Support customer assurance activities, including completing security questionnaires and participating in customer discussions.
Participate in and contribute to cross-functional project teams.
Perform other tasks as assigned to help the company meet its goals.