GRC Analyst

FloQast•Los Angeles, CA

3d•$115,000 - $155,000•Hybrid

About The Position

FloQast is hiring a GRC Analyst to support its Compliance team in managing compliance controls, organizational policies, procedures, and standards that address regulatory requirements and information security practices. The role builds relationships with teams across the company and helps align departmental workflows with a strong compliance program. The Compliance department reports to the General Counsel and oversees compliance with security and privacy frameworks including GDPR, CPRA, ISO 27001, ISO 27701, ISO 42001, SOC 1, and SOC 2. The team advises, directs, trains, and monitors the organization, working with departments on a range of business initiatives. The position requires working in the office three days per week. This requirement may change based on team and business needs and is subject to ongoing review. Visa sponsorship is not available at this time.

Requirements

3–5+ years of relevant experience.
Knowledge of or familiarity with at least one security, privacy, or compliance practice, such as SOC 1, SOC 2, ISO 27001, ISO 27701, ISO 42001, PCI, or HIPAA.
Understanding of information security and privacy fundamentals.
Confidence and willingness to ask questions and raise issues or concerns in a timely manner.
Understanding of AI governance or experience leveraging AI tools to improve compliance and audit efficiency.

Nice To Haves

A certification in CompTIA, CISSP, CISA, CISM, or a cloud platform such as AWS, Azure, or GCP is preferred.
Familiarity with NIST, CIS, or other information security frameworks.
Experience working for a software development company.
Collaborative, detail-oriented, intellectually curious, and highly organized, with a friendly demeanor.
A builder mindset, comfort sharing ideas and trying new approaches, and focus on short- and long-term team and company goals.
Flexibility and adaptability in a high-growth startup environment.

Responsibilities

Manage the internal controls inventory as controls are added or changed.
Maintain accurate and current documentation for control owners, testing procedures, related policies, and other relevant control information.
Work with control owners to document and annually update process narratives for all controls.
Initiate, monitor, and follow up on monthly and quarterly control activities to ensure timely completion and appropriate audit evidence.
Promote security and compliance and foster a risk-aware culture across the company.
Draft and maintain policies, standards, processes, and guidelines; gather approvals and report changes in policy review meetings.
Support annual internal and external audits, including ISO 27001, ISO 27701, ISO 42001, SOC 1, SOC 2, and similar audits, by scheduling interviews, requesting and reviewing evidence, following up with control owners, and facilitating follow-up requests.
Aggregate identified internal control issues, conduct root cause analysis, and collaborate on remediation efforts.
Advocate for compliance best practices and serve as a point of contact for stakeholders across departments.
Support customer assurance activities, including completing security questionnaires and participating in customer discussions.
Participate in and contribute to cross-functional project teams.
Perform other tasks as assigned to help the company meet its goals.