Senior GRC Analyst

Turing

About The Position

We're looking for a Senior GRC Analyst to help run our governance, risk, and compliance program day to day. This is a strong individual-contributor role for someone who knows compliance frameworks inside and out, can lead audits with confidence, and can turn control requirements into practical work that teams across the company can actually execute. You'll own key parts of our compliance certifications, run risk and vendor assessments, maintain our control framework, and be a trusted partner to engineering and business teams as they meet their security and compliance obligations.

Requirements

Several years of experience (typically 4+ years) in GRC, compliance, audit, or risk.
Hands-on experience supporting or leading SOC 2 and/or ISO 27001 audits.
Solid understanding of control frameworks, risk assessment methodologies, and vendor risk management.
Strong organization and attention to detail, with the ability to manage multiple workstreams and deadlines.
Clear communicator who can work effectively with both technical and non-technical teams.
Comfort with GRC/compliance tooling.

Nice To Haves

Relevant certifications (CISA, CISSP, CIPP, or similar).
Experience with compliance automation and continuous controls monitoring.
Familiarity with cloud environments and how technical controls are implemented.
Experience supporting enterprise sales and customer security due diligence.

Responsibilities

Own and coordinate compliance audits and certifications (SOC 2, ISO 27001, and others), including evidence collection, auditor coordination, and remediation tracking.
Maintain and improve our control framework, mapping controls across multiple frameworks to reduce duplicate work.
Conduct risk assessments — identifying, documenting, and tracking risks to resolution.
Run the vendor/third-party risk program: security reviews of vendors and ongoing monitoring.
Support customer security reviews and questionnaires, and help maintain the trust center.
Develop, maintain, and socialize security policies and standards.
Partner with control owners across the company to ensure controls are operating effectively, and drive remediation when they aren't.
Identify opportunities to automate manual GRC work and partner with GRC engineering to implement them.