Senior GRC Analyst
About The Position
Semperis is hiring a Senior GRC Analyst to independently own key governance, risk, and compliance programs supporting customer trust and the company’s security and compliance posture. The role owns SOC 2, ISO 27001, and HIPAA audit activities; customer security questionnaires and due diligence; and upkeep of information security policies, standards, and procedures. It also drives follow-through on non-FedRAMP audit findings and supports FedRAMP work during certification phases. The analyst works with the Head of Risk and Compliance, the PMO, consultants, Engineering, Product, Legal, People Operations, and control owners, securing results through influence rather than formal authority. The role also backs up teammates in vendor risk, risk exceptions, and Trust Center work, and supports risk reporting, the GRC platform, security awareness, and process automation. The position is hybrid in-office in Hoboken, New Jersey; Addison, Texas; Phoenix, Arizona; or Austin, Texas. The hybrid model involves working up to three days per week in the office and remotely the remaining days. U.S. citizenship is required. Semperis describes its culture as purpose-driven and focused on employee growth, support, and work-life balance.
Requirements
- At least 5 years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
- A degree in Cybersecurity or one of the following certifications: CISSP, CRISC, CISM, or CISA.
- Experience with SOC 2 Type II and ISO 27001 audits and attestation.
- Clear written and verbal communication skills, including the ability to explain technical control details to engineers, business owners, and customers.
- A track record of achieving results through influence with engineers and other stakeholders who do not report to the role.
- U.S. citizenship.
- Ability to work under the hybrid model at one of the specified locations, with up to three days per week in the office.
Nice To Haves
- Hands-on experience in at least four areas: security policy and standards; GRC operations; third-party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work; running an audit or assessment; or security assurance, including control testing and gap analysis.
- Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
- Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
- Experience automating control monitoring and evidence collection (“compliance as code”).
- Experience answering customer security questionnaires at scale with AI-assisted tools.
- GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
- Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
- Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.
Responsibilities
- Coordinate preparation, scheduling, evidence gathering, fieldwork, and reporting for SOC 2 Type II and ISO 27001 audits with the Head of Risk and Compliance, PMO, and compliance consultants.
- Cover HIPAA Security and Breach Notification Rule audits as part of SOC and ISO work.
- Support FedRAMP and other frameworks by researching control requirements, gathering evidence, reviewing deliverables, or producing documentation.
- Perform assigned internal audit, assurance testing, and due diligence work, including M&A.
- Own customer, partner, and prospect security questionnaires and due diligence requests, ensuring responses are accurate and within SLA in coordination with Product, Engineering, and FedRAMP subject-matter experts.
- Handle complex questionnaires escalated by the GRC Analyst and help develop the analyst’s GRC capabilities.
- Build and maintain a reusable questionnaire answer library using AI-assisted, automated, and manual processes.
- Drive remediation timelines for non-FedRAMP audit findings by recommending dates, tracking milestones, and following up with Engineering control owners.
- Escalate blockers on high-risk remediation items to the Head of Risk and Compliance or CISO, and hold control owners to deadlines through clear communication and data.
- Maintain information security policies, standards, and procedures; draft updates and align them with NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2.
- Coordinate policy review, approval, publication, and acknowledgment with policy owners, People Operations, and Legal.
- Monitor regulatory, customer, and threat landscape changes and recommend policy updates.
- Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when needed.
- Help define and report KPIs and KRIs and support the cyber risk register.
- Help administer the Vanta GRC platform and identify opportunities to automate work such as evidence collection, control monitoring, and framework cross-mapping.
- Support the security awareness training program.
- Deliver at least one measurable automation or process improvement that reduces manual work, as a stated first-year success measure.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
