Cybersecurity GRC Analyst

Semperis is hiring a Cybersecurity GRC Analyst to support governance, risk, compliance, and customer trust work, including its certification and audit programs. The role owns the annual security awareness training campaign and supports customer security questionnaires, audits, policy updates, vendor risk, and FedRAMP work.

What you'll do:

• Follow up on overdue security training, then lead the annual Security and Compliance Training campaign: work with People Operations and Legal on the curriculum, set up enrollments in the training platform, track completion weekly, and escalate overdue training
• Handle training exceptions, keep training records ready as audit evidence, and gather feedback to improve next year's campaign
• Answer customer security questionnaires, starting with simpler requests and taking on more within your first few months. Escalate complex requests to senior teammates
• Check answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain our answer library and Trust Center content
• Learn our FedRAMP program and support the FedRAMP ISSO as needed
• Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets each request, and prepare it for review before it goes to auditors
• Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records
• Recommend improvements to team processes, status reporting, and work priorities
• Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors
• Provide administrative support for the cyber risk register, including intake of new risk information
• Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection

What they're looking for:

• One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity
• At least 6 months of experience in a GRC role
• Strong organization, attention to detail, and follow-through on deadlines
• Clear written and verbal communication skills
• Working knowledge of Microsoft 365 and Excel, and comfort using AI-assisted tools
• 2 to 3 years of work experience in IT, cybersecurity, or GRC
• Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee
• Experience with a modern GRC platform such as Vanta
• Experience answering customer security questionnaires
• Experience at a SaaS, cloud, or cybersecurity company

Benefits:

• Learn GRC across every domain alongside experienced GRC, security, and engineering professionals; take on more complex customer trust, policy, risk, and FedRAMP work as your skills grow.
• For roles with a required location, a hybrid work model: work up to three days per week in the office and remotely the remaining days.