Senior GRC Analyst

Ping Identity

2d•$115,000 - $159,000•Remote

About The Position

Ping Identity is hiring a Senior GRC Analyst to support and enhance its global governance, risk, and compliance programme. The role drives key elements of the security assurance framework, including risk assessments, policy governance, audit support, control testing, third-party risk oversight, and cross-functional remediation initiatives. Reporting to the GRC Manager, the analyst works with Engineering, Privacy, Legal, the People Team, and other business stakeholders. The role helps maintain a robust, scalable compliance posture aligned with ISO 27001, SOC 2, and applicable regulatory requirements, translating complex security and regulatory obligations into practical, business-aligned controls. This is a full-time, remote role based in the United States.

Requirements

Hands-on experience supporting ISO 27001 and SOC 2 audits, including evidence gathering, control documentation, and auditor engagement.
Strong understanding of risk management principles and experience conducting structured risk assessments and driving remediation activities.
Experience reviewing and testing security controls across corporate and cloud-based environments.
Working knowledge of cloud platforms such as AWS, Azure, or GCP and how compliance requirements apply in cloud-native environments.
Familiarity with third-party risk management processes and supplier assurance activities.
Strong communication skills and ability to translate regulatory and technical requirements into clear, practical guidance for business stakeholders.
Excellent organisational skills and ability to manage multiple audits, assessments, and projects concurrently.

Nice To Haves

Relevant professional certifications such as CISM, CISSP, or equivalent.

Responsibilities

Own and support key components of Ping Identity’s global GRC programme, ensuring alignment with ISO 27001, SOC 2, and applicable regulatory and contractual obligations.
Lead and conduct enterprise- and product-level risk assessments, identifying, assessing, and tracking remediation of security and compliance risks with stakeholders.
Support external audits and certifications, including ISO 27001 surveillance and recertification audits and SOC 2 assessments, through evidence collection, control walkthroughs, and auditor coordination.
Develop, review, and maintain security policies, standards, and procedures in alignment with business and regulatory requirements.
Perform assurance activities to validate control design and operating effectiveness, identify gaps, and drive remediation plans.
Operate and improve the third-party risk management programme, including supplier risk assessments, due diligence reviews, and ongoing monitoring of critical vendors.
Track and report compliance metrics, audit findings, risk trends, and remediation progress to Information Security leadership and governance forums.
Partner with Engineering, Product, Privacy, Legal, the People Team, and other business units to embed security and compliance requirements into processes and initiatives.
Support continuous improvement across the GRC function by streamlining processes, enhancing tooling, and improving reporting and visibility.