Vercel GRC Analyst at Vercel builds governance, risk, and compliance programs using AI tooling. This role manages audits, assesses AI tools, and maintains compliance documentation across multiple standards.
Responsibilities
We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London, with three days a week in the office.
Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training
Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress
Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores
Manage annual audit deliverables, write treatment plans, and track completion across teams
Answer customer compliance inquiries and maintain customer-facing security and compliance documentation
Qualification
Built an automation or internal tool
Required
3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment
Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review
Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners
Led compliance projects across multiple business units and seniority levels
Built an automation or internal tool, with code or AI coding tools, even outside an engineering role
Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework
Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification
Preferred
Built automation or internal tools with code or AI coding tools
Experience with AI governance frameworks such as ISO/IEC 42001 or NIST AI Risk Management Framework
Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP)
