Senior GRC Analyst - Central or Eastern time, US or Canada

Shift Technology • Boston, MA

3h • $120,000 - $150,000 • Hybrid

About The Position

As a Senior GRC Analyst, you will be a cornerstone of Shift’s security program, responsible for developing, maintaining, and assessing the company’s integrated security and privacy management framework. You will manage compliance with key industry standards, lead risk assessments, oversee the third-party security assurance program, and support TrustOps efforts involving customer collateral, questions, contract reviews, and due diligence. The role helps ensure Shift meets regulatory obligations and maintains customer trust. It is part of the Information Security department and reports to the GRC Lead.

Requirements

• 7+ years of proven experience in a GRC, IT Audit, Security Assurance, or Information Security role.
• Bachelor’s degree in a relevant field or equivalent work experience.
• Deep knowledge of security and privacy frameworks, such as ISO 27001, ISO 27701, SOC 2 Type II, HITRUST, and NIST CSF.
• Strong knowledge of global privacy and healthcare regulations, such as GDPR and HIPAA.
• Working knowledge of business continuity, disaster recovery, and incident response planning, including plan structure, exercise, and test methodologies.
• Hands-on experience with modern GRC management tools, including connecting integrations, tuning automated evidence collection and monitoring tests, and building custom controls and frameworks.
• Exceptional communication and presentation skills, with the ability to translate complex compliance requirements into clear business guidance.
• Strong stakeholder management skills and the ability to influence and align teams without direct authority.
• Strong organization and project management skills, with the ability to manage multiple audits and assessments simultaneously.
• Analytical mindset and ability to balance regulatory requirements with business objectives and priorities.

Nice To Haves

• Professional certifications such as CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, or CISSP.
• Direct experience delivering in highly regulated industries such as financial services or healthcare.
• Direct experience managing or supporting formal audit and certification processes from start to finish.
• Working knowledge of AI regulations, frameworks, and standards such as the EU AI Act and ISO 42001.
• Experience with Drata, including connecting integrations, tuning automated evidence collection and monitoring tests, and building custom controls and frameworks.

Responsibilities

• Translate Shift’s global information security expectations into actionable policies, standards, and procedures.
• Promote security and compliance across the organization, transfer knowledge of standards, and act as a subject matter expert.
• Contribute to the security awareness program and ensure it aligns with policy and compliance requirements.
• Partner with the Data Protection Officer to develop and maintain privacy policies, data handling standards, and public-facing privacy notices in line with privacy laws and global regulations such as GDPR.
• Develop and maintain the security assurance plan, ensuring key controls are effectively designed and implemented to meet Shift policies and standards.
• Improve the third-party information security assurance and continuous assessment process.
• Identify key risk areas with engineering and business teams and facilitate security control evaluations and testing.
• Review architectural designs and new initiatives to ensure alignment with security policies and effective risk mitigation.
• Identify potential information security GRC problem areas and execute plans to improve the assurance workflow.
• Support and facilitate Data Protection Impact Assessments (DPIAs) for new products and initiatives.
• Manage and coordinate internal and external audits for certifications such as ISO 27001 and SOC 2 Type II.
• Analyze and compile documentation and evidence demonstrating the compliance level of systems, services, and controls.
• Work with internal teams to manage remediation of audit findings and track them to closure.
• Support legal and stakeholder teams in responding to Data Subject Access Requests (DSARs).
• Communicate with third parties and suppliers to conduct risk assessments, review their security posture, and manage remediation of identified issues.

Benefits

• Flexible remote and hybrid working options.
• Competitive salary and a variable component tied to personal and company performance.
• Learning and development opportunities, including Focus Fridays, a half-day each month for learning and personal growth.
• Generous paid time off and paid holidays.
• Mental health benefits.
• Two paid volunteering days per year (Make A Difference Days).
• Additional benefits may be offered by country, based on eligibility.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior