Senior GRC Specialist

Skills

About the Role

You will run day-to-day GRC operations, including access reviews, security awareness activities, policy exceptions, and JML tracking. You will manage risk and vendor assessments, maintain audit readiness, test controls, coordinate audit evidence and remediation, update policies, and report actionable program metrics.

Requirements

• 5–7 years of experience in GRC, IT audit, information security, or a related field
• Working knowledge of SOC 2, ISO 27001, ISO 27701, ISO 42001, NIST CSF, HIPAA, GDPR, or CCPA
• Experience with GRC platforms
• Experience running user access reviews and knowledge of IAM concepts
• Experience administering a security awareness or phishing simulation platform
• Comfort with AWS, GCP, or Azure environments
• Strong written communication
• Ability to manage multiple audits, campaigns, and deadlines

Responsibilities

• Manage day-to-day GRC operations, including access reviews, security awareness activities, JML tracking, and policy exceptions
• Perform risk assessments, maintain the risk register, and track remediation to closure
• Run vendor and subprocessor risk assessments and ongoing monitoring
• Design internal audits and support external audit cycles
• Administer the GRC platform and maintain continuous control monitoring and evidence automation
• Educate control owners and prepare them for audits
• Review and update security policies, standards, and procedures
• Translate program findings into risk insights and leadership metrics

Benefits

• Equity