Senior GRC Analyst

Semperis

. Own SOC, ISO, and HIPAA audit programs .

Posted 11/5/2026full-timeUnited StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in managing SOC, ISO, and HIPAA audit programs while ensuring compliance with regulatory frameworks such as FedRAMP and NIST. Proficient in coordinating audits, maintaining information security policies, and effectively communicating technical details to diverse stakeholders.

Highest-signal resume keywords

SOC 2 Type II Audit ExperienceISO 27001 Audit ExperienceGRC Experience in Information Security RiskCISSP CertificationExperience with Vanta

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Audit CoordinationInformation Security PoliciesCompliance FrameworksEvidence CollectionRisk AssessmentControl MonitoringSecurity QuestionnairesPolicy DraftingKPI and KRI ReportingM&A Due Diligence

Soft Skills

Clear CommunicationInfluencing StakeholdersCollaborationProblem-SolvingAttention to Detail

Tools & Technologies

VantaDrataOneTrustArcherServiceNow

Certifications & Qualifications

CISSPCRISCCISMCISA

Industry Keywords

GRCCybersecurityHIPAANIST SP 800-53FedRAMPISO 42001AuditComplianceRisk ManagementVendor Risk

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Own SOC, ISO, and HIPAA audit programs
Own customer security questionnaires and due diligence requests
Maintain information security policies, standards, and procedures
Coordinate audit scoping, scheduling, evidence collection, fieldwork, and reporting for SOC 2 Type II and ISO 27001 audits
Cover HIPAA Security and Breach Notification Rules audits
Support FedRAMP and other compliance frameworks through control research, evidence gathering, deliverable review, and documentation
Perform internal audit, assurance testing, and due diligence work, including M&A
Answer customer, partner, and prospect security questionnaires accurately within SLA
Build and maintain a reusable answer library using AI-assisted, automated, and manual processes
Drive remediation timelines with Engineering for audit findings and escalate high-risk blockers
Draft and align policies with NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2
Coordinate policy review, approval, publication, and acknowledgement with policy owners, People Operations, and Legal
Monitor regulatory, customer, and threat landscape changes and recommend policy updates
Back up vendor risk, risk exception, and Trust Center activities
Help define and report KPIs and KRIs and support the cyber risk register
Administer Vanta and automate evidence collection, control monitoring, and framework cross-mapping
Support the security awareness training program
Coordinate preparation for the ISO 27001 audit scheduled for February 2027

Requirements

What you’ll need

5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company
A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA
SOC 2 Type II and ISO 27001 audit and attestation experience
Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers
Track record of getting results through influence with engineers and other stakeholders who don't report to you
U.S. citizenship
Preferred: hands-on experience in at least four GRC areas, including security policy and standards, GRC operations, vendor risk management, cyber and technology risk assessment, risk registers and reporting, customer trust work, audits or assessments, and security assurance
Preferred: experience with FedRAMP, NIST 800-53, or other government compliance frameworks
Preferred: hands-on configuration of modern GRC platforms such as Vanta, Drata, OneTrust, Archer, or ServiceNow
Preferred: experience automating control monitoring and evidence collection
Preferred: experience answering customer security questionnaires at scale with AI-assisted tools
Preferred: GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries
Preferred: familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF
Preferred: experience with M&A due diligence, IPO readiness, audit test plan development, quantitative cyber risk analysis, business continuity, incident response, or continuous monitoring plans

Benefits

Comp & perks

Hybrid work model: up to three days per week onsite and the remaining days remotely
Employee experience focused on purpose, growth, and balance
AI and GRC tooling, including Vanta
Global team environment
Reasonable accommodation for applicants with disabilities
Equal employment opportunity protections