Senior GRC Analyst

Tines

. Drive audit cycles end to end for SOC 2 Type II and ISO 27001 / 27701 / 42001, including evidence collection, control testing, auditor liaison, and remediation tracking .

Posted 10/16/2026full-timeRemote • United StatesSenior💰 $175,000 - $190,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in IT compliance, security, and risk management, with a strong focus on SOC 2 and ISO 27001 compliance frameworks. Proficient in conducting vendor security assessments, managing compliance initiatives, and automating compliance processes using tools like Tines.

Highest-signal resume keywords

SOC 2 Compliance FrameworksISO 27001 ComplianceFedRAMP Certification SupportVendor Security AssessmentsRisk Management

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Evidence CollectionControl TestingContinuous Control MonitoringRisk AnalysisCompliance AutomationSecurity Policy DevelopmentAudit ProcessesControl Drift DetectionCloud Security PrinciplesPrivacy Regulations

Soft Skills

Exceptional Communication SkillsProject Management Skills

Tools & Technologies

TinesCompliance Automation ToolsScripting/API Experience

Certifications & Qualifications

CISSPCISACISM

Industry Keywords

IT ComplianceSecurityRisk ManagementSaaSTechnology CompaniesGDPRCCPA3PAOAudit Firm ExperienceRemote-First Environments

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud Platform

About the role

Key responsibilities & impact

Drive audit cycles end to end for SOC 2 Type II and ISO 27001 / 27701 / 42001, including evidence collection, control testing, auditor liaison, and remediation tracking
Support gap assessments for new certifications
Support FedRAMP efforts through gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors
Operate continuous control monitoring, including scan and pen test reporting, control drift detection, and evidence freshness
Run vendor security assessments and mature the third-party risk program
Conduct risk analyses for systems, processes, and third-party applications and implement mitigating controls
Respond to customer security inquiries, questionnaires, and audit requests; support Sales on RFPs and RFQs; maintain Trust Center documentation
Partner with Legal on contract security and compliance reviews, security provisions, compliance risks, and standardized security language
Use Tines to automate compliance processes, evidence collection, and reporting
Review, update, and develop security policies and procedures
Partner with Engineering, Product, IT, Legal, HR, and leadership to embed compliance requirements
Monitor evolving compliance standards and regulatory requirements

Requirements

What you’ll need

8-12 years of experience in IT compliance, security, or risk management
Hands-on experience implementing or maintaining ISO 27001 compliance
Strong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testing
Experience supporting FedRAMP certification processes and requirements
Experience conducting vendor security assessments and risk analyses
Excellent understanding of information security principles, controls, and best practices
Strong project management skills, with the ability to manage multiple compliance initiatives simultaneously
Exceptional communication skills for translating technical requirements to non-technical stakeholders
Previous experience on the audit side — at a 3PAO or audit firm (e.g. Coalfire, Schellman, KPMG) — or driving gap remediation for certification readiness
Industry certifications such as CISSP, CISA, or CISM
Experience with compliance automation tools and techniques, or scripting/API experience for evidence automation
Continuous monitoring (ConMon) and compliance reporting experience
Knowledge of cloud security principles and controls (AWS, Azure, GCP)
Experience reviewing contracts for security and compliance requirements
Experience in SaaS or technology companies
Familiarity with privacy regulations (GDPR, CCPA)
Experience working in remote-first environments
Applicants must be authorized to work for any employer in the U.S.; employment visa sponsorship is unavailable