[Hiring] Senior GRC Analyst @GoTo

Role Description

The Compliance Analyst sits within the Security Governance, Risk, and Compliance (GRC) team, reporting to the Director of GRC in the CISO org. You'll own audit coordination, control testing, and risk assessment work while actively improving how assurance gets done through technology and automation.

As a GRC Compliance Analyst, you'll be working on:

• Coordinating: audits across ISO 27001, SOC 2, PCI DSS, HIPAA, NIS2, SOX, and C5, including managing auditor relationships, driving evidence collection, and tracking remediation activities to completion.
• Performing: control assessments and testing across technical and administrative domains, partnering with engineering and security teams to evaluate control design and effectiveness.
• Collaborating with: Engineering, Security, IT, and Product stakeholders to understand technical architectures and translate them into audit-ready control narratives.
• Leveraging: AI tools, automation, and emerging technologies to streamline evidence collection, control testing, and reporting activities.
• Administering and enhancing: GRC platforms while developing metrics and dashboards that provide visibility into compliance posture and control effectiveness.

Qualifications

• 4+ years of experience in information security compliance, audit, or risk management within a technology environment.
• Strong understanding of cloud architecture, IAM, infrastructure, and SDLC controls, enabling effective collaboration and communication with technical teams.
• Experience working with one or more compliance frameworks, such as ISO 27001, SOC 2, PCI DSS, HIPAA, NIST 800-53, or NIS2.
• Strong audit communication skills: you know how to manage auditors, push back when evidence requests are out of scope, and defend a control position when you're right.
• Active user of AI tools to improve your own productivity.

Requirements

• Experience with compliance automation, continuous monitoring initiatives, or GRC platform development.
• Experience with platforms such as Thoropass, AuditBoard, or Drata.
• Experience building AI-driven workflows or automations that reduce compliance toil.
• Experience integrating GRC tooling with engineering, cloud, identity, or monitoring platforms.
• Experience implementing continuous assurance capabilities.

Benefits

• Comprehensive health benefits.
• Generous paid time off, including paid holidays, volunteer days, quarterly self-care days, and company-designated no-meeting days.
• Tuition reimbursement and access to instructor-led and on-demand learning and development programs.
• The Thrive Global Wellness Program, a confidential Employee Assistance Program (EAP), a wellness app and one-on-one wellness coaching.
• Employee-led communities and programs, including Employee Resource Groups (ERGs), GoTo Gives, and charitable matching.