GRC Analyst

We are seeking a detail-oriented and analytical GRC Analyst to support our organization's Governance, Risk, and Compliance initiatives. The GRC Analyst will be responsible for driving compliance with regulatory and industry standards, assessing security risks, and implementing best practices to strengthen the company’s security and risk posture. This role involves collaborating with multiple teams to maintain a robust GRC framework, including IT, cloud & infrastructure, people operations, product, and engineering across our business units.

In This Role, You Will:

• Ensure alignment of security policies with regulatory and industry frameworks (e.g., HIPAA, SOC 2, NIST, privacy laws).
• Support internal and external audits by gathering evidence and ensuring adherence to security controls.
• Conduct compliance gap analyses and recommend improvements.
• Work with stakeholders to remediate non-compliance issues.
• Assist in developing, reviewing, and maintaining security policies, standards, and procedures.
• Monitor third-party vendors for security risks and compliance with contractual obligations.
• Support the development and delivery of security awareness training programs.
• Develop metrics and reports to track compliance status, risk trends, and audit findings.

Qualifications:

• 5+ years of experience in GRC, risk management, or compliance roles.
• Strong understanding of regulatory frameworks such as HIPAA, SOC 2, or NIST CSF.
• Preference for expertise in compliance against NYS SSP with DOH OHIP.
• Experience in conducting risk assessments and audits.
• Demonstrated ability to solve problems through analytical thinking and communicate effectively with stakeholders.

Other Information:

• Compensation: $80,000-$100,000 USD
• Location: Remote
• Benefits: Annual company bonus, 401k matching, medical, dental and vision healthcare coverage, unlimited PTO, paid holidays, volunteer time off, paid parental leave, etc.