[Hiring] Senior GRC Analyst @Compyl

Role Description

Our customers don't just need a platform that tracks their GRC program. They need a trusted voice who can help them think through it. As a Senior GRC Analyst, you'll be the person customers turn to when a risk assessment gets complicated, an audit raises an unexpected question, or a policy needs to be adapted to their specific environment.

This role goes beyond process execution and platform support. You'll bring real GRC judgment to every customer interaction, recognizing when a question is more complex than it looks, and guiding customers through it with the confidence of someone who has actually done this work before.

What You'll Do

• Serve as a hands-on GRC advisor for a portfolio of customers, guiding them through risk assessments, risk registers, audit preparation, and control rollouts.
• Help customers prepare for and navigate audits (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST, and similar frameworks), translating requirements into practical next steps.
• Advise on policy development and control design tailored to each customer's risk profile and maturity level — not just “what the framework says,” but what actually makes sense for them.
• Spot GRC complexity early — recognizing when a customer's question touches on risk, compliance, or audit nuance that needs more than a standard playbook answer.
• Partner closely with Support and Customer Success to own the escalations that require real GRC expertise, not just product knowledge.
• Turn recurring customer questions into scalable guidance — playbooks, internal knowledge base content, and best-practice frameworks the whole team can use.
• Act as the voice of the customer internally, flagging where our platform could better support real-world GRC workflows.

Qualifications

• 5+ years of experience as a GRC analyst, consultant, or coordinator — in-house, at a consulting firm, or in a similar capacity.
• Direct, hands-on experience with audits, risk assessments and risk registers, and policy rollouts — you've been in the room, not just read about it.
• Working familiarity with common frameworks (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST, or similar) — deep specialization isn't required, but you should be able to orient quickly in any of them.
• An instinct for GRC complexity: you can tell when something is more nuanced than it first appears, and you know how to break it down for someone who's stuck.
• Strong consultative communication skills — you can explain a compliance concept to a nontechnical stakeholder without losing the substance.
• A genuine interest in helping customers solve problems, not just closing tickets.

Requirements

• Certifications such as CISA, CRISC, CGRC, or ISO 27001 Lead Implementer/Auditor.
• Experience working directly with a GRC software platform (as a practitioner, implementer, or vendor-side consultant).
• Exposure to multiple industries or company sizes, giving you a broader sense of how GRC programs vary in practice.

Benefits

• Competitive salary and meaningful equity participation at a Series A inflection point.
• Comprehensive paid benefits, including health insurance, 401(k), and generous leave policies.