GRC Analyst

Job not on LinkedIn

🔥 1 hour ago

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🎲 Risk

👻 Ghost score 25%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Upwind Security

WebsiteLinkedInAll Job Openings

51 - 200 employees

🔐 Security

☁️ SaaS

Security • SaaS • Cloud Security

Upwind Security is a next-generation cloud security company that specializes in providing comprehensive protection for multi-cloud infrastructures. Their platform consolidates various security tools, offering cloud security posture management (CSPM), runtime vulnerability management, and API security, among other features. Upwind Security focuses on delivering real-time threat detection and vulnerability prioritization to enhance team efficiency and reduce organizational risks. With a strong emphasis on empowering DevOps and Security teams, Upwind Security simplifies cloud security management, offering solutions that address critical infrastructure and application security needs.

📋 Description

• Operate and improve Upwind's GRC and security compliance programs • Support compliance work across SOC 2, ISO 27001, NIST, and FedRAMP, including control implementation, evidence collection, documentation, remediation tracking, continuous monitoring, and audit readiness • Coordinate audit and compliance evidence from Engineering, IT, Security, Legal, and HR • Translate compliance requirements into clear actions for technical and business teams • Perform control assessments, gap analyses, and risk assessments, and recommend remediation • Work with process owners to build sustainable, evidence-based remediation • Track vulnerabilities, risks, audit findings, and POA&Ms through completion • Handle customer security questionnaires, due diligence requests, and security documentation • Support third-party risk management and vendor security assessments • Write and maintain policies, standards, procedures, and control documentation • Maintain GRC systems, evidence repositories, and risk registers • Research new regulatory and customer requirements and determine their applicability • Use AI and automation to accelerate research, documentation, evidence organization, and workflow with appropriate validation and data handling • Raise gaps and issues early with proposed fixes

🎯 Requirements

• 3 to 5 years in GRC, cybersecurity, risk management, compliance, or audit • Familiarity with NIST 800-53, SOC 2, ISO 27001, NIST CSF, or similar frameworks • Experience supporting audits, assessments, security questionnaires, or evidence collection • Strong written communication and documentation skills • Technical fluency to work effectively with Engineering, IT, and Security • Ability to turn audit findings into adoptable remediation plans • Comfort working in a fast-moving environment where priorities shift • Demonstrated use of technology to improve GRC work, including risk analysis, evidence collection, control monitoring, remediation tracking, research, customer trust, or workflow automation • Organized and detail-oriented • Nice-to-have: FedRAMP, NIST 800-53, or other U.S. government compliance experience, including POA&Ms, continuous monitoring, or assessment activities • Nice-to-have: Experience working with external assessors on formal readiness or assessment activities • Nice-to-have: Cloud security experience, particularly AWS or AWS GovCloud • Nice-to-have: Background in SaaS, cloud security, or a high-growth technology company • Nice-to-have: Experience with a global, distributed workforce across time zones • Nice-to-have: Hands-on experience with cloud-based GRC, compliance automation, or AI-enabled workflow platforms • Nice-to-have: Experience building GRC automations, integrations, or dashboards • Nice-to-have: Familiarity with Jira, GitHub, or similar tools • Certifications such as Security+, CISA, CRISC, CISM, CGRC, or ISO 27001 are nice to have

🏖️ Benefits

• Full-time employment • Remote work in the United States