Senior GRC Analyst - Central or Eastern time, US or Canada

Role overview Lead work across an information security and privacy governance, risk, and compliance program. The role covers policy and control assurance, audits, privacy assessments, and third-party reviews, partnering with technical and business teams to reduce risk and maintain customer confidence.

Responsibilities - Turn security expectations into practical policies, standards, and procedures, and support organization-wide security awareness. - Work with privacy stakeholders on data handling policies, privacy notices, and impact assessments for new initiatives. - Maintain the security assurance plan; identify risks with engineering and business teams, evaluate controls, and review new designs. - Coordinate ISO 27001 and SOC 2 Type II audits, assemble evidence, and track remediation through completion. - Assess suppliers’ security practices and follow up on identified risks; support customer assurance requests and data access requests.

Requirements - At least seven years in GRC, IT audit, security assurance, or information security. - A relevant degree or equivalent professional experience. - Experience delivering work in a regulated industry, such as financial services or healthcare. - Direct experience managing or supporting formal audits and certifications from start to finish. - Deep knowledge of security and privacy frameworks, including ISO 27001, ISO 27701, SOC 2 Type II, HITRUST, or NIST CSF.

Nice to have - Certifications such as CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, or CISSP.

Benefits and work setup - Remote or hybrid flexibility; the role is listed for candidates in US or Canada Central or Eastern time zones. - Stated base salary range: $120,000–$150,000 USD, with additional incentive pay and benefits. - Paid time off and holidays, learning opportunities, mental health support, and paid volunteering days.