GRC Analyst

The shape of it

In the posting’s own words

We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London, with three days a week in the office.

Also a plus

• Built an automation or internal tool, with code or AI coding tools, even outside an engineering role
• Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework
• Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification

What the job covers

• Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training
• Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress
• Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores
• Manage annual audit deliverables, write treatment plans, and track completion across teams
• Answer customer compliance inquiries and maintain customer-facing security and compliance documentation

Tools and skills named

Words the posting leans on

• security9×
• compliance8×
• controls6×
• audit5×
• privacy4×
• tools4×
• data3×
• risk3×
• status3×
• systems3×
• vendors3×
• audit evidence2×
• build automations2×
• built2×
• certified information2×
• completion2×

Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.

More open at Vercel

• Account Executive, CommercialRemote - Germany
• Account Executive, MajorsHybrid - London
• Account Executive, Majors (APAC)Hybrid - Sydney
• Account Executive, Majors- Install Base (APAC)Hybrid - Sydney
• Account Executive-Startups, EMEA (French Speaker)Hybrid - London
• Account Executive- Startups, GreenfieldHybrid - San Francisco, New York City, Austin