GRC (Governance, Risk, and Compliance) Analyst

YipitData

7h•Remote

About The Position

YipitData is seeking a Governance, Risk, and Compliance (GRC) Analyst to help evaluate whether security controls are operating effectively, provide evidence that they work, identify risks, and adapt governance as the company’s products, technology, and use of AI grow. The role spans audits, risk assessments, control testing, vendor reviews, customer questionnaires, policies, and compliance programs. The analyst will work with Security, IT, Engineering, Legal, Finance, and People teams to understand business processes, identify improvement opportunities, and ensure follow-through. This is a hands-on role focused on understanding and challenging evidence, not simply uploading documents to an audit platform. The analyst will own GRC workstreams from request through completion, help keep the company audit-ready, assess and test controls, coordinate recurring compliance activities, maintain program documentation, and track remediation. The role also involves simplifying or automating repetitive work and helping develop governance for AI products, agents, and new data practices. The position may be performed remotely anywhere in the United States, in NYC, or in one of YipitData’s office hubs. Work hours are flexible, although most employees work East Coast hours. Remote work outside the company’s offices may be subject to New York State tax withholding.

Requirements

Experience in security, compliance, risk, audit, privacy, vendor risk, or another field involving evaluation of whether requirements are met.
Hands-on SOC 2 experience, including supporting Type I or Type II audits, testing controls, validating evidence, coordinating with auditors, and tracking remediation to completion.
Ability to evaluate whether evidence actually proves that a control is working.
Ability to connect policy or framework requirements with real-world activities and systems.
Familiarity with SOC 2, NIST CSF, or similar security and compliance frameworks.
Strong writing skills and ability to explain complex requirements clearly to people unfamiliar with security frameworks.
Attention to inconsistencies, missing information, and answers that do not add up.
Comfort asking follow-up questions and respectfully challenging information when needed.
Ability to organize multiple workstreams, meet deadlines, and follow through.
Strong communication skills with technical and non-technical teams, including explaining why requirements matter.
Ownership, sound judgment, and ability to work independently or escalate when appropriate.
Ability to work in a changing environment where processes or answers may not always be established.

Nice To Haves

Interest in how governance needs to evolve for AI and other emerging technologies.

Responsibilities

Own GRC workstreams from initial requests through evidence collection, testing, remediation, and completion.
Help maintain audit readiness throughout the year.
Test security controls and determine whether they are operating effectively.
Conduct risk assessments, identify gaps, and help teams develop practical remediation plans.
Map controls across SOC 2 and other frameworks to reduce duplication where controls satisfy multiple requirements.
Coordinate recurring activities such as access reviews, control testing, policy reviews, risk updates, and audit evidence requests.
Review vendors and assess whether their security practices meet company expectations.
Support customer security questionnaires by locating and validating information and ensuring responses are accurate and consistent.
Translate compliance requirements into clear actions for teams.
Draft and maintain policies, standards, control narratives, risk records, metrics, and other program documentation.
Track findings and remediation commitments, follow up with owners, and ensure issues are resolved.
Identify opportunities to simplify and automate repetitive GRC work.
Help develop governance for emerging technologies, including AI products, agents, and new approaches to handling data.