We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team runs the policy, risk, compliance, and customer trust programs that let security-conscious enterprises, regulated industries, and government customers adopt Semperis products with confidence.
As our Senior GRC Analyst, you'll own three core programs: SOC/ISO/HIPAA Audits, customer security questionnaires and upkeep of our security policies and standards. You'll also be the day-to-day point of contact for remediation follow through on audit findings, and you'll support our FedRAMP work on occasion during certification phases.
We're a small team, so you'll back up teammates on vendor risk, risk exceptions, and our Trust Center when the queue gets heavy, and you'll be the person our GRC Analyst turns to for very complex questionnaires. You'll run your programs independently, bring recommendations to the Head of Risk and Compliance on scoping, policy, and higher-risk decisions, and get results through influence rather than authority.
You'll succeed by being accurate, organized, and persuasive with engineers and business owners who don't report to you. You'll have AI and GRC tooling, including Vanta, to help you work efficiently.
Work with the Head of Risk and Compliance for scoping and timing, then work with our PMO and Compliance consultants to prepare for, schedule, evidence, and execute on the fieldwork and reporting phases of the SOC2 Type II and ISO 27001 Audits. You’ll have support as needed from other team members.
Cover HIPAA Audits (Security and Breach Notification Rules) as part of our SOC and ISO work.
Support FedRAMP program and other frameworks as needed by researching control requirements, gathering evidence, reviewing deliverables, or producing documentation.
Take on internal audit, assurance testing, and due diligence work, including M&A, when assigned.
Own customer, partner, and prospect security questionnaires and due diligence requests. Answer accurately and within SLA, working with Product and Engineering and/or FedRAMP SMEs to confirm answers.
Take on the very complex questionnaires our GRC Analyst escalates, and help the analyst grow in GRC areas that are new to them.
Build and maintain our reusable answer library using a mix of AI-assisted, automated, and manual processes.
Remediation Follow Through
Qualification
Experience with FedRAMPGRC experience at a cybersecurity
Preferred
Hands-on experience in at least four of these areas: security policy and standards; GRC operations; third party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work (questionnaires, due diligence, Trust Center); running an audit or assessment; and security assurance (control testing and gap analysis).
Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.
Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.
Experience automating control monitoring and evidence collection ("compliance as code").
Experience answering customer security questionnaires at scale with AI-assisted tools.
GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.
Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.
Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.
