Senior GRC Analyst

Crusoe•San Francisco, CA

1d•$130,000 - $155,000

About The Position

Crusoe is seeking a Senior GRC Analyst to own and drive the day-to-day execution of its Governance, Risk, and Compliance program. Reporting to the Head of GRC, this role runs core security and privacy compliance operations, including user access reviews, audit evidence, customer trust support, and vendor risk. It also applies SOX expertise to IT controls that support internal controls over financial reporting, from identifying gaps through remediation. The role maintains continuous compliance by keeping audits on track, maintaining policies and standards, responding to customer security inquiries, and improving the GRC platform. The senior analyst operates independently, owns full audit cycles, and partners with stakeholders across IT, Security, Finance, and Engineering. The position also emphasizes efficiency through AI tools and automation to reduce manual effort and scale program impact.

Requirements

5–7 years of experience in GRC, information security, IT audit, or a related compliance role, with demonstrated ownership of end-to-end audit cycles.
Practical knowledge of compliance frameworks such as SOC 2, ISO 27001, HIPAA, and NIST CSF.
Solid understanding of SOX 404 audit requirements and IT general controls, with hands-on experience identifying control gaps and working with stakeholders to remediate them.
Hands-on experience with GRC platforms.
Experience conducting user access reviews, vendor risk assessments, and internal audits.
Familiarity with responding to customer security questionnaires and managing trust center content.
Comfort using AI tools such as Gemini, Claude, or Copilot to accelerate day-to-day work and improve operational efficiency.
Strong written and verbal communication skills, including the ability to explain compliance requirements to technical and non-technical audiences and influence control owners without direct authority.
Highly organized, self-directed, and able to manage multiple priorities and stakeholders independently.
Detail-oriented, with strong follow-through on recurring operational tasks.

Nice To Haves

Experience with Vanta, the preferred GRC platform; experience with Drata, AuditBoard, or similar platforms is also valued.
Certifications such as CISA, CRISC, CISSP, Security+, or ISO 27001 Lead Auditor.
Background in public accounting and/or high-growth technology companies navigating SOX compliance.
Experience with cloud environments, preferably GCP; AWS or Azure exposure is helpful.
Familiarity with financial systems such as ERP, billing, or revenue recognition platforms.
Experience with policy management and security awareness training platforms.
Familiarity with AI risk assessment frameworks and emerging AI governance practices.
Experience mentoring junior analysts or leading cross-functional compliance initiatives.

Responsibilities

Apply SOX audit expertise to support the design, operation, and testing of IT general controls, including access management, change management, and computer operations; maintain related control documentation, process narratives, and risk-control matrices.
Evaluate in-scope systems and processes for SOX control gaps and partner with control owners across IT, Finance, and Engineering to develop and drive remediation plans through closure.
Collect, organize, and deliver audit evidence for SOX, SOC 2, ISO 27001, HIPAA, and other framework requirements.
Work with internal control owners to ensure evidence is accurate, current, and audit-ready.
Serve as a day-to-day contact for internal and external auditors, manage requests, and facilitate walkthroughs.
Respond to evidence and documentation requests for strategic initiatives.
Coordinate and complete recurring User Access Reviews across in-scope systems and applications, including systems supporting financial reporting.
Maintain and update organizational security policies and standards to reflect regulatory and business requirements.
Conduct third-party security assessments and support reviews of vendor contracts for compliance with security requirements.
Respond to customer security questionnaires and due diligence requests within established SLAs.
Maintain and update the Security Diligence Playbook to make responses consistent, accurate, and efficient.
Drive enhancements to the GRC tool, including asset management, integrations, test configurations, control mapping, review workflows, and risk objects.
Identify opportunities to streamline and automate repetitive GRC workflows, including continuous control monitoring.
Use AI and LLM-based tools to improve compliance operations, such as accelerating questionnaire responses, summarizing audit evidence, and drafting policy updates.
Track and report compliance metrics and control health to GRC leadership.