Security Governance Risk & Compliance Analyst I

Commerce

1d • $49,729 - $73,130

About The Position

Commerce is seeking a detail-oriented, curious GRC Analyst to support the day-to-day operations of its Governance, Risk & Compliance team. The role supports third-party vendor assessments, policy documentation, control evidence tracking, audit activities, and related reporting. It is intended for someone early in their career who wants to build a foundation in enterprise risk management and information security compliance while working with a senior, globally distributed team.

Requirements

• 0–2 years of experience in GRC, risk operations, compliance, or a related function; internships count.
• Bachelor's degree in Computer Science, Cybersecurity, Information Systems, Business, or a related field; equivalent work experience is also considered.
• Genuine interest in GRC engineering and willingness to learn quickly in a fast-paced environment.
• Hands-on familiarity with Claude Code or similar AI coding tools, and ability to consider how they could be applied to cybersecurity or GRC work; hobby projects are welcome.
• Strong written and verbal communication skills for cross-functional work and communication with external vendors.
• High attention to detail and comfort working with documentation, spreadsheets, and tracking tools.
• Proficiency in Microsoft Office or Google Workspace.

Nice To Haves

• Coursework or certification in cybersecurity or risk management, such as Security+ or CISA.
• Exposure to compliance frameworks such as SOC 2, ISO 27001, NIST, or PCI-DSS.
• Experience in an operations or process-driven role, including an internship.

Responsibilities

• Review vendor security questionnaires, documentation, and due diligence materials to support third-party risk assessments.
• Maintain and update the vendor risk register and track remediation activities through closure.
• Assist with internal control testing and evidence collection for compliance frameworks such as SOC 2, ISO 27001, and PCI-DSS.
• Help coordinate audit requests and liaise with internal stakeholders to gather required documentation.
• Monitor policy and procedure documentation and flag items due for review or update.
• Track risk exceptions and escalate items requiring senior review.
• Support preparation of reports and metrics for leadership and committee-level reviews.
• Contribute to process improvement initiatives as the program scales.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level