GRC Associate – Contract

Unit21

. Run day-to-day GRC work in Drata, including control mapping, integration connections, gap closure and evidence collection .

Posted 11/10/2026full-timeRemote • United StatesJuniorMid-Level💰 $50 - $65 per hourWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Governance, Risk, and Compliance (GRC) processes, including SOC 2 Type II audits, compliance automation platforms, and security assessments. Proficient in managing security documentation, coordinating audits, and maintaining compliance across various teams and functions.

Highest-signal resume keywords

GRC ManagementSOC 2 Type II Audit SupportCompliance Automation PlatformsSecurity Questionnaire ResponsesISO 27001 Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Control MappingEvidence CollectionAudit Log ExportsRisk Assessment CoordinationPCI DSS ExposureSecurity AssessmentsCompliance Calendar ManagementBackground ChecksControl TestingIncident Summaries

Soft Skills

Clear WritingOrganizedPersistentCustomer-Facing Communication

Tools & Technologies

DrataVantaSecureframeOneTrust

Certifications & Qualifications

Security+CISAISO 27001 Implementer

Industry Keywords

B2B SaaSFintechBaaSBanking VendorNIST AI RMFISO 42001

About the role

Key responsibilities & impact

Run day-to-day GRC work in Drata, including control mapping, integration connections, gap closure and evidence collection
Coordinate SOC 2 Type II audit activities, including auditor coordination, evidence requests, walkthroughs, exception tracking and remediation
Run biannual and quarterly PCI reviews and track external scan findings to closure
Prepare recurring SOC 2 evidence, including access and group reviews, audit-log exports and incident summaries
Track postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops
Respond to security questionnaires, DDQs and customer vendor-risk reviews
Maintain the security answer library and obtain Security sign-off for new or changed security claims
Build customer screenshot evidence packs and maintain the Trust Center
Review customer security requirements in MSAs and DPAs and maintain the requirements tracker
Run annual security policy reviews and manage the policy exceptions log
Coordinate the annual risk assessment, maintain the risk register and prepare leadership risk reviews
Coordinate the annual BCP/DR test and write the customer-facing summary
Track HR-side SOC 2 controls, including background checks, security training, onboarding and offboarding
Conduct security assessments of internal-use and non-critical vendors and support critical vendor and subprocessor reviews
Maintain the subprocessor list and drive customer notifications when it changes
Run intake and review for new SaaS apps, OAuth apps, AI tools and MCP servers
Handle day-to-day compliance for data-provider reseller agreements, starting with LexisNexis
Build and manage a compliance calendar of recurring controls, reviews, audits and renewals
Send a monthly GRC status report to the Head of Security

Requirements

What you’ll need

2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers
Supported at least one SOC 2 Type II audit, including evidence collection, control testing and auditor requests
Answered customer security questionnaires or DDQs
Clear writing; customer-facing answers should need only light review
Organized and persistent, able to track many small asks across teams and follow up without escalation
Hands-on experience with a compliance automation platform such as Drata, Vanta, Secureframe or OneTrust
Fintech, BaaS or banking-vendor experience
ISO 27001 experience
AI governance experience, including NIST AI RMF or ISO 42001
PCI DSS exposure
Security+, CISA or ISO 27001 Implementer certification
US work location in one of: AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA
Availability for approximately 20 hours per week and at least 4 hours of overlap with US Pacific time

Benefits

Comp & perks

Competitive salary and pre-IPO equity
100% company-paid medical, dental, and vision insurance for employees
Unlimited PTO and generous leave programs
401(k)
Learning & development stipend
Home office setup support
Flexible hours within the week
Renewable 6-month initial contract term
30 days' notice to end contract