About this role

Own end-to-end audit cycles across SOC 2, ISO 27001, and PCI DSS — scoping, evidence collection, assessor coordination, and finding remediation
Lead gap analysis and maintain audit-ready documentation and policies in the trust center
Drive continuous monitoring obligations, including PCI DSS monthly reporting and SAQ completion
Partner with IT, Engineering, and Sales to implement security controls and support vendor security questionnaires
Maintain risk registers and incident playbooks as the business evolves

3–4+ years of hands-on GRC experience with proven end-to-end audit cycle management across SOC 2, ISO 27001, and/or PCI DSS
Hands-on experience with a GRC automation platform (Drata, Vanta, Anecdotes, or equivalent)
Experience with trust portal and questionnaire management tooling (SafeBase, Responsive, or equivalent)
Strong written communication skills — able to produce clear, audit-ready policies and documentation
Proven ability to manage multiple compliance workstreams independently with minimal oversight
Familiarity with NIST CMMC, FERPA, HIPAA, or TX-RAMP/GovRAMP
Experience with vulnerability management platforms (Wiz, Tenable, Qualys, or equivalent)
Comfort using AI-assisted tools to accelerate documentation and GRC workflows

Cybersecurity Analyst

Key skills