Senior GRC Analyst

At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.

Location: Hybrid In-Office: Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX

About the Role

We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team runs the policy, risk, compliance, and customer trust programs that let security-conscious enterprises, regulated industries, and government customers adopt Semperis products with confidence.

As our Senior GRC Analyst, you'll own three core programs: SOC/ISO/HIPAA Audits, customer security questionnaires and upkeep of our security policies and standards. You'll also be the day-to-day point of contact for remediation follow through on audit findings, and you'll support our FedRAMP work on occasion during certification phases.

We're a small team, so you'll back up teammates on vendor risk, risk exceptions, and our Trust Center when the queue gets heavy, and you'll be the person our GRC Analyst turns to for very complex questionnaires. You'll run your programs independently, bring recommendations to the Head of Risk and Compliance on scoping, policy, and higher-risk decisions, and get results through influence rather than authority.

You'll succeed by being accurate, organized, and persuasive with engineers and business owners who don't report to you. You'll have AI and GRC tooling, including Vanta, to help you work efficiently.

What You Will Do

Compliance

• Work with the Head of Risk and Compliance for scoping and timing, then work with our PMO and Compliance consultants to prepare for, schedule, evidence, and execute on the fieldwork and reporting phases of the SOC2 Type II and ISO 27001 Audits. You’ll have support as needed from other team members.

• Cover HIPAA Audits (Security and Breach Notification Rules) as part of our SOC and ISO work.

• Support FedRAMP program and other frameworks as needed by researching control requirements, gathering evidence, reviewing deliverables, or producing documentation.

• Take on internal audit, assurance testing, and due diligence work, including M&A, when assigned.

Customer Trust

• Own customer, partner, and prospect security questionnaires and due diligence requests. Answer accurately and within SLA, working with Product and Engineering and/or FedRAMP SMEs to confirm answers.

• Take on the very complex questionnaires our GRC Analyst escalates, and help the analyst grow in GRC areas that are new to them.

• Build and maintain our reusable answer library using a mix of AI-assisted, automated, and manual processes.

Remediation Follow Through

• Drive remediation dates with Engineering for non-FedRAMP audit findings: set recommended timelines, track milestones, and follow up with control owners.

• Escalate blockers on high-risk items to the Head of Risk and Compliance or the CISO, and hold control owners to deadlines through clear communication and data, without formal authority over their teams.

Policy and Governance

• Own the upkeep of our information security policies, standards, and procedures: draft updates and align them with frameworks such as NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2.

• Work with policy owners, People Operations, and Legal to get changes reviewed, approved, published, and acknowledged.

• Stay current on regulatory, customer, and threat landscape changes, and recommend policy updates before they become audit findings.

Team Coverage and Continuous Improvement

• Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when an owner is out or the queue is heavy.

• Help define and report KPIs and KRIs, and support the cyber risk register.

• Help administer our GRC platform (Vanta) and find manual work to automate, such as evidence collection, control monitoring, and framework cross mapping.

• Support our security awareness training program.

What You Will Bring (Required)

• 5+ years of experience in GRC, information security risk, compliance, or IT audit, including experience at a SaaS company.

• A degree in Cybersecurity, or one of these certifications: CISSP, CRISC, CISM, or CISA.

• SOC 2 Type II and ISO 27001 audit and attestation experience.

• Clear written and verbal communication, with the ability to explain technical control details to engineers, business owners, and customers.

• A track record of getting results through influence with engineers and other stakeholders who don't report to you.

Preferred Qualifications

• Hands-on experience in at least four of these areas: security policy and standards; GRC operations; third party and vendor risk management; cyber and technology risk assessment and risk exceptions; risk registers and risk reporting; customer trust work (questionnaires, due diligence, Trust Center); running an audit or assessment; and security assurance (control testing and gap analysis).

• Experience with FedRAMP, NIST 800-53, or other government compliance frameworks.

• Hands-on configuration of a modern GRC platform such as Vanta, Drata, OneTrust, Archer, or ServiceNow.

• Experience automating control monitoring and evidence collection ("compliance as code").

• Experience answering customer security questionnaires at scale with AI-assisted tools.

• GRC experience at a cybersecurity, identity, or infrastructure software company serving regulated industries.

• Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF.

• Experience with M&A due diligence or IPO readiness, audit test plan development, quantitative cyber risk analysis, or business continuity, incident response, or continuous monitoring plans.

Success Measures (First Year)

• In your first 90 days, you take over customer questionnaires, remediation tracking, and policy upkeep, and cross-train on vendor reassessments, with accurate, on-time work.

• Coordinate preparation efforts for ISO 27001 Audit scheduled for February 2027.

• Questionnaires in your scope are answered within SLA, accurately and without overstating our security posture.

• Control owners consistently meet evidence and remediation deadlines without needing escalation.

• Our policy set is current, approved, and ready for audit.

• You deliver at least one measurable automation or process improvement that reduces manual work for the team.

• You're a trusted backup across GRC areas, so the team can rebalance work when it needs to.

Additionally, this position requires the following:

• U.S. citizenship.

#LI-MR1

Why Join Semperis?
You’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life—we’d love to meet you.

**Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days.