Staff GRC Analyst

Job summary

The role involves joining the Information Security team as a Staff GRC Analyst, focusing on governance, risk, and compliance as the organization scales. The position emphasizes building compliance automation and collaborating with various teams to ensure security and compliance across the business.

Qualifications

• Significant experience in Security GRC and understanding of auditing processes, including internal and external audits.
• Demonstrated experience in using AI and coding for automation in compliance controls.
• Strong understanding of cloud architectures (AWS or equivalent) and their relation to security controls.
• Experience in automating reporting for GRC programs, including dashboards and summaries for executives.
• Background in fintech, payments, or IT audit, with knowledge of regulatory expectations.
• Relevant certifications such as CISM, CISSP, CISA, or PCI-related credentials; a degree in Cybersecurity, Engineering, or related fields is advantageous.

Responsibilities

• Automate legacy systems related to governance, risk, and compliance frameworks.
• Engineer GRC workflows with internal systems to support compliance.
• Design scalable GRC architectures for evidence collection and compliance reporting.
• Draft and maintain security policies aligned with control standards.
• Automate responses to security requests from customers and prospects.
• Automate third-party vendor assessments against compliance standards.
• Track and report on compliance metrics and KPIs for leadership visibility.
• Translate compliance requirements into technical specifications for engineering teams.
• Coordinate multi-team workstreams to ensure clear priorities and delivery.
• Contribute to the broader Cybersecurity team and support shared goals.

Skills

• High-agency and initiative in developing time-saving solutions.
• Ability to work with non-engineering colleagues.

Education

• Degree in Cybersecurity, Engineering, Computer Science, Mathematics, or equivalent experience is a plus.

Tools

• Familiarity with compliance frameworks such as ISO 27001, PCI-DSS, and DORA.