Senior GRC AnalystLocation: Remote
The RoleOur customers don't just need a platform that tracks their GRC program. They need a trusted voice who can help them think through it. As a Senior GRC Analyst, you'll be the person customers turn to when a risk assessment gets complicated, an audit raises an unexpected question, or a policy needs to be adapted to their specific environment.
This role goes beyond process execution and platform support. You'll bring real GRC judgment to every customer interaction, recognizing when a question is more complex than it looks, and guiding customers through it with the confidence of someone who has actually done this work before.
What You'll Do- Serve as a hands-on GRC advisor for a portfolio of customers, guiding them through risk assessments, risk registers, audit preparation, and control rollouts.
- Help customers prepare for and navigate audits (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST, and similar frameworks), translating requirements into practical next steps.
- Advise on policy development and control design tailored to each customer's risk profile and maturity level - not just "what the framework says," but what actually makes sense for them.
- Spot GRC complexity early - recognizing when a customer's question touches on risk, compliance, or audit nuance that needs more than a standard playbook answer.
- Partner closely with Support and Customer Success to own the escalations that require real GRC expertise, not just product knowledge.
- Turn recurring customer questions into scalable guidance - playbooks, internal knowledge base content, and best-practice frameworks the whole team can use.
- Act as the voice of the customer internally, flagging where our platform could better support real-world GRC workflows.
What We're Looking For- 5+ years of experience as a GRC analyst, consultant, or coordinator - in-house, at a consulting firm, or in a similar capacity.
- Direct, hands-on experience with audits, risk assessments and risk registers, and policy rollouts - you've been in the room, not just read about it.
- Working familiarity with common frameworks (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST, or similar) - deep specialization isn't required, but you should be able to orient quickly in any of them.
- An instinct for GRC complexity: you can tell when something is more nuanced than it first appears, and you know how to break it down for someone who's stuck.
- Strong consultative communication skills - you can explain a compliance concept to a nontechnical stakeholder without losing the substance.
- A genuine interest in helping customers solve problems, not just closing tickets.
Nice to Have- Certifications such as CISA, CRISC, CGRC, or ISO 27001 Lead Implementer/Auditor.
- Experience working directly with a GRC software platform (as a practitioner, implementer, or vendor-side consultant).
- Exposure to multiple industries or company sizes, giving you a broader sense of how GRC programs vary in practice.
COMPENSATION & BENEFITSCompetitive salary and meaningful equity participation at a Series A inflection point. Comprehensive paid benefits, including health insurance, 401(k), and generous leave policies.
