Senior GRC Analyst

Semperis • Phoenix, AZ

2d • Hybrid

About The Position

Semperis is hiring a Senior GRC Analyst to manage key governance, risk, and compliance programs that support customer trust across complex hybrid identity environments. The role owns SOC 2, ISO 27001, and HIPAA audit work; customer security questionnaires; and maintenance of information security policies and standards. It also leads follow-through on non-FedRAMP audit remediation and provides occasional support for FedRAMP certification activities.

Working as part of a small team, the Senior GRC Analyst independently runs assigned programs and backs up colleagues on vendor risk, risk exceptions, and the Trust Center when needed. The role handles complex questionnaires escalated by the GRC Analyst, supports that analyst’s development, and brings recommendations on scope, policy, and higher-risk matters to the Head of Risk and Compliance. Success depends on accurate, organized work and the ability to influence engineers and business owners without formal authority. AI and GRC tools, including Vanta, are available to support the work.

The position follows a hybrid work model from the Hoboken, New Jersey; Addison, Texas; Phoenix, Arizona; or Austin, Texas office, with up to three days per week in the office and the remaining days remote. U.S. citizenship is required.

Requirements

• At least 5 years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
• A degree in Cybersecurity or one of the following certifications: CISSP, CRISC, CISM, or CISA.
• Experience with SOC 2 Type II and ISO 27001 audits and attestations.
• Clear written and verbal communication skills, including the ability to explain technical control details to engineers, business owners, and customers.
• A track record of achieving results through influence with engineers and other stakeholders who do not report to you.
• U.S. citizenship.

Nice To Haves

• Hands-on experience in at least four of the following areas: security policy and standards; GRC operations; third-party and vendor risk management; cyber and technology risk assessments and risk exceptions; risk registers and risk reporting; customer trust work such as questionnaires, due diligence, and Trust Center; running an audit or assessment; and security assurance, including control testing and gap analysis.
• Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
• Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
• Experience automating control monitoring and evidence collection, or compliance as code.
• Experience answering customer security questionnaires at scale using AI-assisted tools.
• GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
• Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
• Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.

Responsibilities

• Coordinate scoping and timing with the Head of Risk and Compliance, and work with the PMO and compliance consultants to prepare, schedule, gather evidence for, and execute SOC 2 Type II and ISO 27001 audits and reporting.
• Cover HIPAA Security and Breach Notification Rule audits as part of SOC and ISO work.
• Support FedRAMP and other frameworks by researching control requirements, gathering evidence, reviewing deliverables, and producing documentation.
• Perform assigned internal audit, assurance testing, and due diligence work, including M&A.
• Own customer, partner, and prospect security questionnaires and due diligence requests; provide accurate responses within SLA and confirm answers with Product, Engineering, or FedRAMP subject-matter experts as needed.
• Handle complex questionnaires escalated by the GRC Analyst and help the analyst develop in new GRC areas.
• Build and maintain a reusable questionnaire answer library using AI-assisted, automated, and manual processes.
• Drive remediation dates for non-FedRAMP audit findings by recommending timelines, tracking milestones, and following up with Engineering and control owners.
• Escalate high-risk blockers to the Head of Risk and Compliance or the CISO, and use clear communication and data to hold control owners to deadlines without formal authority.
• Maintain information security policies, standards, and procedures; draft updates and align them with NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2.
• Coordinate policy reviews, approvals, publication, and acknowledgements with policy owners, People Operations, and Legal.
• Monitor regulatory, customer, and threat landscape changes and recommend policy updates before they become audit findings.
• Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when workload or coverage requires.
• Help define and report KPIs and KRIs and support the cyber risk register.
• Help administer the Vanta GRC platform and identify manual work to automate, including evidence collection, control monitoring, and framework cross-mapping.
• Support the security awareness training program.
• Coordinate preparation for the ISO 27001 audit scheduled for February 2027 and deliver at least one measurable automation or process improvement during the first year.

Benefits

• Employee experience focused on purpose, growth, and balance.
• Hybrid work model with up to three days per week in the office and the remaining days remote.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior