Senior GRC Analyst

Semperis•Addison, TX

2d•Hybrid

About The Position

Semperis is seeking a Senior GRC Analyst to own key governance, risk, and compliance programs that support customer trust and security-conscious enterprise, regulated-industry, and government customers. The role's core areas are SOC/ISO/HIPAA audits, customer security questionnaires, and maintaining security policies and standards. The analyst will also coordinate audit-finding remediation, support FedRAMP work during certification phases, and provide backup across vendor risk, risk exceptions, and the Trust Center. The Senior GRC Analyst will run programs independently, coordinate with the Head of Risk and Compliance, PMO, consultants, engineers, business owners, and other stakeholders, and deliver results through influence rather than formal authority. The role includes administering the Vanta GRC platform, improving processes through automation, supporting security awareness training, and contributing to risk reporting. The position is hybrid, based in Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX, with up to three days per week in-office and the remaining days remote. U.S. citizenship is required.

Requirements

At least 5 years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
A degree in Cybersecurity or one of the following certifications: CISSP, CRISC, CISM, or CISA.
Experience with SOC 2 Type II and ISO 27001 audits and attestations.
Clear written and verbal communication skills, including the ability to explain technical control details to engineers, business owners, and customers.
A track record of getting results through influence with engineers and other stakeholders who do not report to you.
U.S. citizenship.

Nice To Haves

Hands-on experience in at least four of the following: security policy and standards; GRC operations; third-party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work; running an audit or assessment; and security assurance, including control testing and gap analysis.
Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
Experience automating control monitoring and evidence collection (compliance as code).
Experience answering customer security questionnaires at scale using AI-assisted tools.
GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.

Responsibilities

Coordinate the preparation, scheduling, evidence gathering, fieldwork, and reporting for SOC 2 Type II and ISO 27001 audits with the Head of Risk and Compliance, PMO, and compliance consultants.
Cover HIPAA Security and Breach Notification Rules audits as part of SOC and ISO audit work.
Support FedRAMP and other frameworks by researching control requirements, gathering evidence, reviewing deliverables, and producing documentation.
Conduct assigned internal audit, assurance testing, due diligence, and M&A work.
Own customer, partner, and prospect security questionnaires and due diligence requests, ensuring accurate responses within SLA and confirming answers with Product, Engineering, and FedRAMP subject-matter experts as needed.
Handle complex questionnaires escalated by the GRC Analyst and help develop that analyst's GRC capabilities.
Build and maintain a reusable questionnaire answer library using AI-assisted, automated, and manual processes.
Drive remediation timelines for non-FedRAMP audit findings by setting recommended dates, tracking milestones, and following up with Engineering and control owners.
Escalate blockers on high-risk findings to the Head of Risk and Compliance or CISO and hold control owners accountable for deadlines through clear communication and data.
Maintain information security policies, standards, and procedures; draft updates and align them with applicable frameworks.
Coordinate policy reviews, approvals, publication, and acknowledgments with policy owners, People Operations, and Legal.
Monitor regulatory, customer, and threat landscape changes and recommend policy updates.
Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when needed.
Help define and report KPIs and KRIs and support the cyber risk register.
Help administer Vanta and identify opportunities to automate evidence collection, control monitoring, and framework cross-mapping.
Support the security awareness training program.
Coordinate preparation for the ISO 27001 audit scheduled for February 2027 and deliver at least one measurable automation or process improvement during the first year.