GRC Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Manage and enhance Upwind's GRC and security compliance initiatives.

• Assist with compliance efforts across SOC 2, ISO 27001, NIST, and FedRAMP, which includes control implementation, evidence gathering, documentation, remediation tracking, continuous monitoring, and audit preparation.

• Collaborate with Engineering, IT, Security, Legal, and HR to coordinate audit and compliance evidence.

• Convert compliance requirements into actionable items for technical and business teams.

• Conduct control assessments, gap analyses, and risk evaluations, providing remediation recommendations.

• Partner with process owners to develop sustainable, evidence-driven remediation strategies.

• Monitor vulnerabilities, risks, audit findings, and POA&Ms until resolution.

• Address customer security questionnaires, due diligence inquiries, and security documentation requests.

• Assist in third-party risk management and vendor security evaluations.

• Draft and maintain policies, standards, procedures, and control documentation.

• Oversee GRC systems, evidence repositories, and risk registers.

• Investigate new regulatory and customer requirements to assess their relevance.

• Leverage AI and automation to expedite research, documentation, evidence organization, and workflows while ensuring proper validation and data management.

• Identify gaps and issues promptly, proposing solutions.

⛳️ Requirements

• 3 to 5 years of experience in GRC, cybersecurity, risk management, compliance, or auditing.

• Knowledge of NIST 800-53, SOC 2, ISO 27001, NIST CSF, or similar frameworks.

• Experience in supporting audits, assessments, security questionnaires, or evidence collection.

• Excellent written communication and documentation abilities.

• Technical proficiency to collaborate effectively with Engineering, IT, and Security teams.

• Capability to transform audit findings into implementable remediation strategies.

• Comfort in a dynamic environment where priorities may change.

• Proven track record of utilizing technology to enhance GRC operations, including risk analysis, evidence collection, control monitoring, remediation tracking, research, customer trust, or workflow automation.

• Highly organized and detail-oriented.

• Nice-to-have: Familiarity with FedRAMP, NIST 800-53, or other U.S. government compliance experience, including POA&Ms, continuous monitoring, or assessment activities.

• Nice-to-have: Experience collaborating with external assessors on formal readiness or assessment efforts.

• Nice-to-have: Cloud security experience, especially with AWS or AWS GovCloud.

• Nice-to-have: Background in SaaS, cloud security, or a rapidly growing technology firm.

• Nice-to-have: Experience working within a global, distributed workforce across various time zones.

• Nice-to-have: Practical experience with cloud-based GRC, compliance automation, or AI-driven workflow platforms.

• Nice-to-have: Expertise in developing GRC automations, integrations, or dashboards.

• Nice-to-have: Familiarity with Jira, GitHub, or similar tools.

• Certifications such as Security+, CISA, CRISC, CISM, CGRC, or ISO 27001 are also beneficial.

🏝️ Benefits

• Full-time employment.

• Remote work opportunity within the United States.