Senior GRC Analyst

Semperis

. Own SOC, ISO, and HIPAA audit programs, including scoping, scheduling, evidence collection, fieldwork, and reporting .

Posted 11/5/2026full-timeUnited StatesSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in GRC, information security risk, and compliance, with a strong focus on SOC, ISO, and HIPAA audit programs. Proficient in managing complex security questionnaires and automating evidence collection while ensuring alignment with regulatory standards.

Highest-signal resume keywords

GRC ExperienceSOC 2 Type II Audit ExperienceISO 27001 Audit ExperienceCISSP CertificationFedRAMP Compliance Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information Security Risk ManagementCompliance AuditingControl MonitoringEvidence CollectionPolicy DevelopmentRisk AssessmentDue DiligenceKPI and KRI ReportingCyber Risk AnalysisIncident Response Planning

Soft Skills

Clear CommunicationInfluencing StakeholdersCollaborationProblem SolvingAttention to Detail

Tools & Technologies

VantaDrataOneTrustArcherServiceNowAI-Assisted Tools

Certifications & Qualifications

CISSPCRISCCISMCISA

Industry Keywords

SOCISOHIPAANIST SP 800-53FedRAMPSaaSM&ARegulated IndustriesContinuous MonitoringSecurity Awareness Training

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Own SOC, ISO, and HIPAA audit programs, including scoping, scheduling, evidence collection, fieldwork, and reporting
Support the FedRAMP program and other frameworks through control research, evidence gathering, deliverable review, and documentation
Perform internal audit, assurance testing, and due diligence work, including M&A
Own customer, partner, and prospect security questionnaires and due diligence requests
Handle complex questionnaires and help develop the GRC Analyst
Build and maintain a reusable answer library using AI-assisted, automated, and manual processes
Drive remediation timelines for non-FedRAMP audit findings with Engineering
Track milestones, follow up with control owners, and escalate high-risk blockers
Maintain information security policies, standards, and procedures aligned with NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2
Coordinate policy review, approval, publication, and acknowledgment with policy owners, People Operations, and Legal
Monitor regulatory, customer, and threat landscape changes and recommend policy updates
Back up vendor risk assessments, risk exception reviews, and Trust Center activities
Help define and report KPIs and KRIs and support the cyber risk register
Administer Vanta and automate evidence collection, control monitoring, and framework cross-mapping
Support the security awareness training program
Coordinate preparation for the ISO 27001 audit scheduled for February 2027

Requirements

What you’ll need

5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company
A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA
SOC 2 Type II and ISO 27001 audit and attestation experience
Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers
Track record of getting results through influence with engineers and other stakeholders who do not report to you
U.S. citizenship
Preferred: hands-on experience in at least four specified GRC, risk, audit, assurance, policy, or customer trust areas
Preferred: experience with FedRAMP, NIST 800-53, or other government compliance frameworks
Preferred: hands-on configuration of modern GRC platforms such as Vanta, Drata, OneTrust, Archer, or ServiceNow
Preferred: experience automating control monitoring and evidence collection
Preferred: experience answering customer security questionnaires at scale with AI-assisted tools
Preferred: GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries
Preferred: familiarity with ISO 42001 or NIST AI RMF
Preferred: experience with M&A due diligence, IPO readiness, audit test plan development, quantitative cyber risk analysis, business continuity, incident response, or continuous monitoring plans

Benefits

Comp & perks

Employee experience focused on purpose, growth, and balance
Hybrid work model with up to three days per week in the office and remaining days remotely
Global team environment
Equal employment opportunity and reasonable accommodation under applicable laws