GRC Analyst
About The Position
Avetta’s SaaS platform connects the world’s leading organizations with qualified suppliers, contractors, and vendors. We bring unmatched visibility to companies through cloud-based technology and human insights. As a result, we foster sustainable growth for businesses and their supply chains. Our SaaS subscription software is used by 85k+ active customers in over 100 countries. The GRC Analyst’s primary role is to support the organization’s governance, risk, and compliance activities by performing day-to-day control monitoring, evidence collection, risk assessments, and documentation updates. This role works closely with security, IT, engineering, and business teams to ensure compliance requirements are understood and met. The GRC Analyst helps maintain policies, track remediation tasks, assist with audits, and keep the GRC platform organized and accurate. They play a key part in strengthening the company’s control environment and ensuring ongoing readiness for audits and regulatory obligations. Secondary responsibilities may include assisting monitoring and responding to SOC alerts, implementing and supporting security tools, and other tasks as assigned.
Requirements
- Bachelor’s degree in Information Security, Business, Risk Management, or related field (or equivalent practical experience).
- 1–3+ years of experience in compliance, IT audit, cybersecurity operations, risk management, or a similar field.
- Exposure to common compliance frameworks such as SOC 2, ISO 27001, NIST CSF, SOX, HIPAA, or PCI (hands-on experience is preferred).
- Basic understanding of security controls, audit principles, and risk management concepts.
- Familiarity with cloud technologies (AWS, Azure, GCP) and SaaS environments.
- Ability to review evidence, evaluate control performance, and document findings clearly.
- Strong attention to detail and organizational skills.
- Good communication skills and ability to collaborate with cross-functional teams.
- Ability to manage multiple tasks and maintain accuracy under deadlines.
- Analytical mindset with a willingness to learn and improve processes.
Nice To Haves
- Experience with GRC tools and ticketing systems is a plus.
Responsibilities
- Assist in maintaining security and compliance policies, standards, and procedures.
- Support updates to documentation, control mappings, and compliance workflows.
- Help prepare reports and dashboards for leadership or auditors.
- Support enterprise and departmental risk assessment activities by gathering data, performing initial risk scoring, and documenting findings.
- Track remediation items and follow up with stakeholders to ensure timely completion.
- Maintain the risk register and ensure entries remain current and accurate.
- Collect and organize audit evidence for SOC 2, ISO 27001, PCI, and other frameworks.
- Conduct control testing and gap assessments under the guidance of senior team members.
- Monitor control performance and document exceptions or potential issues.
- Maintain and update GRC platforms (e.g., Vanta, Drata, Anecdotes, OneTrust).
- Help maintain the centralized control library and update mappings across multiple frameworks.
- Assist teams in understanding control requirements and preparing evidence.
- Perform security reviews and tracking of vendors, questionnaire analysis, and documentation
- Assist in developing or distributing compliance training materials and reminders.
- Help ensure employees complete required annual training.
Benefits
- Health, Dental, and Vision Insurance
- 401(k)
- Paid Time Off
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Entry Level
Number of Employees
501-1,000 employees
