Senior Information Security GRC Analyst

The Challenge

Your Mission

Customer Security Assurance & Questionnaires

• Own a high volume of end-to-end completion of customer security questionnaires (CAQs), RFP security sections, and other assurance artifacts (e.g., SIG, CAIQ, custom questionnaires).
• Provide accurate, consistent, and defensible responses by leveraging internal evidence repositories (SOC reports, ISO certificates, policies, standards, diagrams, pen test summaries, etc.).
• Partner with internal stakeholders (Sales, Marketing, Customer Success, Security, Engineering, Privacy, Legal, Compliance, Product) to validate responses and resolve gaps.

Customer Engagement & Security Discussions

• Meet with customers and prospects to explain security controls, risk posture, and compliance commitments.
• Present security topics with confidence and clarity—tailoring depth for technical and non-technical audiences.
• Support Sales and Customer Success by addressing security objections, clarifying customer audit scope, and enabling procurement cycles.

Contract & Security Review

• Perform security reviews of contracts, DPAs, security addenda, and customer security terms.
• Identify security requirements, non-standard obligations, and risk areas; propose mitigations and collaborate with Legal and Security leadership on negotiation positions.
• Track contractual security commitments and help ensure they are operationally feasible and aligned with control coverage.

Operational Excellence

• Improve team efficiency through standardization, playbooks, and continuous refinement of response libraries.
• Demonstrated ability to manage, prioritize, and execute a high volume of concurrent requests with accuracy and consistency, while meeting SLAs and maintaining quality standards in a fast-paced environment.
• Contribute to internal readiness by keeping evidence current, identifying control documentation gaps, and recommending process improvements.

You Are

Your Experience Includes

• 2-5 years of relevant experience in information security, security compliance, GRC, security assurance, third-party risk, or customer trust functions.
• Demonstrated experience responding to customer security questionnaires and security due diligence requests.
• Familiarity with common frameworks and attestations: SOC 2, ISO 27001, NIST, CIS, PCI DSS, HIPAA, GDPR, etc.
• Strong understanding of security fundamentals (e.g., access control, encryption, vulnerability management, secure SDLC, incident response, logging/monitoring, vendor risk).
• Experience collaborating cross-functionally (Security, Legal, Privacy, Engineering, Sales).
• Excellent written and verbal communication skills—able to translate technical controls into clear, customer-ready responses.
• Strong organizational skills and ability to manage multiple requests with competing deadlines.

Preferred Qualifications

• Industry certifications such as CISA and/or CISM (or equivalent).
• Experience reviewing/negotiating security contract terms, security addenda, and customer assurance language.
• Background in SaaS/cloud security assurance or supporting enterprise customers.

Core Competencies

• Customer-oriented mindset with the ability to maintain security rigor while enabling business outcomes.
• Risk-based thinking—knows when to escalate, when to propose mitigations, and how to document decisions.
• Attention to detail and commitment to consistency, defensibility, and evidence-based responses.
• Comfort with ambiguity and strong ability to drive outcomes in a fast-paced environment.
• High-Throughput Execution – Ability to efficiently manage and deliver a high volume of security assurance requests while maintaining quality, accuracy, and timeliness.

What Success Looks Like (First 90 Days)

• Independently handles a steady volume of questionnaires with high accuracy and improved cycle times.
• Builds trusted partnerships with Legal/Privacy/Security to streamline approvals and escalations.
• Leads customer security calls effectively and contributes to deal progression.
• Establishes reusable response patterns and mentors junior staff to raise overall team quality.