Senior GRC Analyst

Semperis•Austin, TX

2d•Hybrid

About The Position

Semperis is hiring a Senior GRC Analyst to run key governance, risk, and compliance programs that support customer trust and adoption of its products. The role owns SOC 2, ISO 27001, and HIPAA audit work; customer security questionnaires; and upkeep of security policies and standards. It also drives remediation follow-through on audit findings and supports FedRAMP work during certification phases. As part of a small GRC team, the Senior GRC Analyst provides backup for vendor risk, risk exceptions, and the Trust Center, and handles complex questionnaires escalated by the GRC Analyst. The role independently runs programs, recommends scoping and policy decisions to the Head of Risk and Compliance, and works through influence rather than formal authority. The position uses AI and GRC tooling, including Vanta. The role is hybrid, based in Hoboken, New Jersey; Addison, Phoenix, or Austin, Texas, with up to three days per week in the office and the remaining days remote. U.S. citizenship is required.

Requirements

At least 5 years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.
A degree in Cybersecurity or one of the following certifications: CISSP, CRISC, CISM, or CISA.
Experience with SOC 2 Type II and ISO 27001 audits and attestations.
Clear written and verbal communication skills, including the ability to explain technical control details to engineers, business owners, and customers.
A track record of achieving results through influence with engineers and other stakeholders who do not report to you.
U.S. citizenship.

Nice To Haves

Hands-on experience in at least four of these areas: security policies and standards; GRC operations; third-party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work; running audits or assessments; and security assurance, including control testing and gap analysis.
Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
Experience automating control monitoring and evidence collection, or compliance as code.
Experience answering customer security questionnaires at scale using AI-assisted tools.
GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.

Responsibilities

Coordinate with the Head of Risk and Compliance, PMO, and compliance consultants to scope, schedule, prepare for, execute, and report on SOC 2 Type II and ISO 27001 audits.
Cover HIPAA Security and Breach Notification Rules audits as part of SOC and ISO work.
Support FedRAMP and other frameworks by researching control requirements, gathering evidence, reviewing deliverables, and producing documentation.
Perform assigned internal audit, assurance testing, due diligence, and M&A work.
Own customer, partner, and prospect security questionnaires and due diligence requests, ensuring accurate responses within SLA and confirming answers with relevant subject-matter experts.
Handle complex questionnaires escalated by the GRC Analyst and help develop the analyst's GRC capabilities.
Build and maintain a reusable questionnaire answer library using AI-assisted, automated, and manual processes.
Drive remediation timelines for non-FedRAMP audit findings with Engineering by setting recommended dates, tracking milestones, and following up with control owners.
Escalate blockers on high-risk remediation items to the Head of Risk and Compliance or CISO, and hold control owners accountable through clear communication and data.
Maintain information security policies, standards, and procedures, aligning them with relevant frameworks and drafting updates as needed.
Coordinate policy reviews, approvals, publication, and acknowledgements with policy owners, People Operations, and Legal.
Monitor regulatory, customer, and threat landscape changes and recommend policy updates.
Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when needed.
Help define and report KPIs and KRIs and support the cyber risk register.
Help administer Vanta and identify opportunities to automate evidence collection, control monitoring, and framework cross-mapping.
Support the security awareness training program.