Senior Governance, Risk, and Compliance (GRC) Analyst (Remote)

RainFocus•Orem, UT

2d•Remote

About The Position

RainFocus is seeking an exceptional Senior Governance, Risk, and Compliance (GRC) Analyst to join their Security and Privacy team. This role involves owning and growing the company's GRC program, including maintaining the control framework, leading risk assessments, supporting audits, and driving program maturity. The analyst will report directly to the CISO and have significant ownership from day one. RainFocus is an innovative software company serving Fortune 500 companies with its event management platform.

Requirements

Bachelor's degree in Technology, Cybersecurity, or a related field is highly desirable.
6+ years of proven experience in GRC, IT audit, information security compliance, or a related field.
In-depth knowledge of relevant regulations, standards, and frameworks (e.g., SOC 2, ISO 27001, PCI DSS, NIST 800-series, GDPR, and others).
Experience running or contributing heavily to formal risk assessments — not just tracking a compliance checklist.
Professional certifications such as CISA, CRISC, CISSP, CIPP, or CIPM are highly desirable.
Familiarity with modern security tooling such as Drata, OneTrust, Vanta, etc.
Strong analytical and problem-solving skills, with keen attention to detail.
Excellent communication and interpersonal skills to work effectively with technical and non-technical stakeholders.
Ability to manage multiple projects and meet deadlines in a fast-paced environment.
Experience with cloud security and compliance frameworks is a plus.
Experience with OneTrust or related GRC technologies is a plus.

Nice To Haves

Experience with cloud security and compliance frameworks is a plus.
Experience with OneTrust or related GRC technologies is a plus.

Responsibilities

Lead RainFocus's GRC program across SOC 2, ISO 27001, PCI DSS, and other client/regulatory compliance frameworks, including audit prep, evidence collection, and auditor relationships.
Manage and mature our control framework, mapping new regulations and conducting gap assessments.
Own the annual security risk assessment process (NIST SP 800-30 methodology), including stakeholder interviews, risk scoring, and residual risk tracking.
Maintain and update security policies, standards, and documentation to ensure compliance with industry best practices.
Partner with Engineering and Security to mature vulnerability management and secrets-scanning practices, moving these from reactive to proactive, pre-deployment controls.
Help build out and operationalize a Data Loss Prevention (DLP) program, including policy design and rollout across email, endpoint, and cloud storage.
Grow and mature RainFocus's security awareness training program.
Drive AI governance efforts — policy, tooling, and monitoring for approved vs. unapproved AI tool usage across the company.
Identify and help close Shadow IT / unmanaged SaaS visibility gaps in partnership with IT.
Collaborate with cross-functional teams to implement risk management practices and ensure compliance across the organization.
Respond to security and privacy inquiries from clients, partners, and employees.
Prepare and present reports on the organization's security and privacy compliance status, including program maturity and remediation progress.
Stay abreast of emerging security threats, vulnerabilities, and compliance requirements.