Senior GRC Analyst

Tines

1d•$175,000 - $190,000•Remote

About The Position

Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to execute and operate compliance programs during a period of growth. Reporting to the Director of GRC, the analyst will support commercial certifications, including SOC 2 Type II and ISO 27001, 27701, and 42001, as well as the FedRAMP program, vendor risk management, and customer security assurance. This is a hands-on execution role that partners with Staff GRC Analysts responsible for certification strategy. The Senior GRC Analyst owns operational delivery, including evidence collection, control testing, audit cycles, vendor assessments, and responses to customer security inquiries. The role also includes automating compliance work using the Tines platform. The position is based remotely in the United States.

Requirements

8–12 years of experience in IT compliance, security, or risk management.
Hands-on experience implementing or maintaining ISO 27001 compliance.
Strong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testing.
Experience supporting FedRAMP certification processes and requirements.
Experience conducting vendor security assessments and risk analyses.
Excellent understanding of information security principles, controls, and best practices.
Strong project management skills, including the ability to manage multiple compliance initiatives simultaneously.
Exceptional communication skills and ability to translate technical requirements for non-technical stakeholders.

Nice To Haves

Previous experience on the audit side at a 3PAO or audit firm, such as Coalfire, Schellman, or KPMG, or experience driving gap remediation for certification readiness.
Industry certifications such as CISSP, CISA, or CISM.
Experience with compliance automation tools and techniques, or scripting/API experience for evidence automation.
Continuous monitoring (ConMon) and compliance reporting experience.
Knowledge of cloud security principles and controls, including AWS, Azure, or GCP.
Experience reviewing contracts for security and compliance requirements.
Experience in SaaS or technology companies.
Familiarity with privacy regulations such as GDPR and CCPA.
Experience working in remote-first environments.

Responsibilities

Drive audit cycles end to end for SOC 2 Type II and ISO 27001, ISO 27701, and ISO 42001, including evidence collection, control testing, auditor liaison, and remediation tracking.
Support gap assessments for new certifications under consideration.
Support FedRAMP efforts through gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors.
Operate year-round continuous control monitoring, including scan and penetration-test reporting, control-drift detection, and evidence-freshness monitoring.
Conduct vendor security assessments, evaluate security controls and compliance posture before acquisition, and help mature the third-party risk program.
Conduct risk analyses for systems, processes, and third-party applications, and implement appropriate mitigating controls.
Respond to customer security inquiries, questionnaires, and audit requests; support Sales on RFPs and RFQs; and keep Trust Center documentation current.
Partner with Legal to review contracts for security and compliance requirements, ensure appropriate security provisions, identify compliance risks, recommend mitigating controls, and help develop standardized security language for different contract types.
Use Tines to streamline compliance processes, evidence collection, and reporting, reducing manual work.
Review, update, and develop security policies and procedures aligned with regulatory requirements and industry best practices.
Partner with Engineering, Product, IT, Legal, HR, and leadership to embed compliance requirements into organizational processes.
Monitor evolving compliance standards and regulatory requirements relevant to the business and its customers.