GRC Analyst – Governance, Risk, Compliance

This is a fully remote position, open to applicants in United States.

📋 Description

• Take charge of GRC workstreams from the initial request stage through evidence collection, testing, remediation, and finalization.

• Maintain YipitData's audit-ready status throughout the entire year.

• Evaluate security controls to assess their operational effectiveness.

• Perform risk assessments, identify gaps, and assist in formulating practical remediation strategies.

• Align controls with SOC 2 and other relevant frameworks.

• Manage access reviews, control testing, policy assessments, risk updates, and requests for audit evidence.

• Review vendor security practices and determine if they align with expectations.

• Support customer security questionnaires by sourcing, validating, and standardizing responses.

• Convert compliance requirements into actionable steps for teams outside of GRC.

• Draft and maintain policies, standards, control narratives, risk records, metrics, and program documentation.

• Monitor findings and commitments to remediation, following up with responsible parties.

• Streamline and automate repetitive GRC tasks.

• Assist in establishing governance for AI products, agents, and innovative data-handling practices.

• Collaborate with Security, IT, Engineering, Legal, Finance, and People teams.

⛳️ Requirements

• Proven experience in security, compliance, risk management, auditing, privacy, vendor risk, or a related area.

• Practical experience with SOC 2, including support for Type I or Type II audits, control testing, evidence validation, auditor coordination, and tracking remediation to completion.

• Knowledge of SOC 2, NIST CSF, or similar security and compliance frameworks.

• Excellent writing skills and the ability to clearly articulate complex requirements.

• Skill in identifying inconsistencies, missing information, and unsupported claims.

• Capacity to ask insightful follow-up questions and respectfully challenge findings.

• Proficiency in organizing multiple workstreams, meeting deadlines, and ensuring follow-through.

• Strong communication abilities with both technical and non-technical teams.

• Sound judgment, a sense of ownership, and the capability to work independently or escalate issues when necessary.

• Interest in governance pertaining to AI and emerging technologies.

• Willingness to work flexible hours, with most employees operating on East Coast time.

• Must reside in the United States.

🏝️ Benefits

• Flexible work hours.

• Flexible vacation policy.

• Competitive 401K matching.

• Parental leave.

• Team-building events.

• Wellness budget.

• Learning reimbursement opportunities.

• Equity options.

• Flexibility for remote work.

• Commitment to equal employment opportunities.