GRC Associate – Contract

This is a fully remote position, open to applicants in Arizona, +15 more locations.

📋 Description

• Oversee daily GRC operations in Drata, which involves control mapping, integration connections, gap closure, and collecting evidence.

• Manage SOC 2 Type II audit processes, including coordination with auditors, evidence requests, walkthroughs, tracking exceptions, and remediation efforts.

• Conduct biannual and quarterly PCI reviews, ensuring external scan findings are addressed and resolved.

• Prepare recurring SOC 2 evidence, such as access and group reviews, audit log exports, and incident summaries.

• Monitor postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR, and People Ops departments.

• Address security questionnaires, due diligence questionnaires (DDQs), and customer vendor-risk assessments.

• Maintain the security answer library and secure Security sign-off for any new or modified security claims.

• Create customer screenshot evidence packs and manage the Trust Center.

• Evaluate customer security requirements in Master Service Agreements (MSAs) and Data Processing Agreements (DPAs), while keeping the requirements tracker updated.

• Conduct annual reviews of security policies and manage the policy exceptions log.

• Facilitate the annual risk assessment, keep the risk register updated, and prepare risk reviews for leadership.

• Coordinate the yearly Business Continuity Plan/Disaster Recovery (BCP/DR) test and draft the customer-facing summary.

• Monitor HR-related SOC 2 controls, including background checks, security training, onboarding, and offboarding processes.

• Perform security assessments for internal-use and non-critical vendors, while assisting with critical vendor and subprocessor evaluations.

• Maintain the subprocessor list and manage customer notifications regarding any changes.

• Oversee the intake and evaluation process for new SaaS applications, OAuth applications, AI tools, and MCP servers.

• Manage day-to-day compliance for data-provider reseller agreements, starting with LexisNexis.

• Establish and oversee a compliance calendar that includes recurring controls, reviews, audits, and renewals.

• Provide a monthly GRC status report to the Head of Security.

⛳️ Requirements

• 2–4 years of experience in GRC, security compliance, or IT auditing, preferably within a B2B SaaS company catering to regulated customers.

• Experience supporting at least one SOC 2 Type II audit, including evidence collection, control testing, and handling auditor requests.

• Proven experience in responding to customer security questionnaires or DDQs.

• Exceptional writing skills; customer-facing responses should require minimal review.

• Highly organized and persistent, capable of managing multiple small requests across teams and following up without escalation.

• Practical experience with a compliance automation platform such as Drata, Vanta, Secureframe, or OneTrust.

• Background in fintech, Banking as a Service (BaaS), or experience as a banking vendor.

• Familiarity with ISO 27001 standards.

• Experience in AI governance, including NIST AI RMF or ISO 42001 frameworks.

• Knowledge of PCI DSS requirements.

• Possession of Security+, CISA, or ISO 27001 Implementer certification.

• Must be located in the US in one of the following states: AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA.

• Availability for approximately 20 hours per week with at least 4 hours overlapping with US Pacific time.

🏝️ Benefits

• Competitive salary along with pre-IPO equity.

• Fully company-paid medical, dental, and vision insurance for employees.

• Unlimited paid time off (PTO) and generous leave programs.

• 401(k) plan.

• Stipend for learning and development opportunities.

• Support for home office setup.

• Flexible working hours during the week.

• Initial contract term of 6 months with the option for renewal.

• 30 days' notice required to terminate the contract.