Staff Security GFC Analyst

About the role

A new role in New York City. Pro members see the company and apply now. It opens to everyone on November 7.

What you'll do

• Lead SOC 2 preparation end to end, from gap assessments and readiness tracking to driving remediation with control owners and working with our external auditor.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools, deciding where human review stays in the loop.
• Run vendor security reviews, keep our security policies current, and answer customer security questionnaires alongside Product and Legal.
• Partner with the CISO to give leadership and the board a clear, evidence-backed view of our security posture, and lay the foundations of GRC as part of a growing Security team.

What they're looking for

• 7, 9 years in GRC, security compliance, or IT audit.
• Hands-on, end-to-end ownership of a security compliance program as its primary owner, ideally including taking a company through its first SOC 2.
• Deep working knowledge of SOC 2 and NIST CSF, including control mapping, audit mechanics (design vs. operating effectiveness, sampling, evidence), and staying current as requirements evolve.
• Enough technical fluency to read a cloud configuration, access setup, or pipeline and judge whether it enforces what the control says. You don't need to write production code.
• Comfort building your own automation with scripts or AI tools.
• Experience standing up continuous controls monitoring or automated evidence collection, including what it covered and what changed as a result.
• Experience applying LLMs to assurance work, such as control drafting, framework mapping, or evidence testing.
• Experience with cloud environments such as AWS or GCP, and with a modern GRC platform.