benepass - Senior GRC Analyst

U.S Remote - Hybrid$130k - $160k+ Equity2mo ago

In Office Senior NA Fintech Cybersecurity Auditor Junior Analyst Risk Management Documentation Governance Due Diligence CFP

Requirements

• 5+ years of experience in GRC, information security compliance, IT audit, risk management, security assurance, or a closely related field. • Hands-on experience supporting SOC 2 audits and readiness activities. • Working knowledge of ISO 27001/27002, HITRUST, NIST CSF, or similar security and compliance frameworks. • Experience maintaining security policies, controls, control narratives, evidence repositories, and audit documentation. • Experience supporting internal or external audits, including evidence collection, auditor coordination, control owner follow-up, and remediation tracking. • Strong written communication skills, with the ability to produce clear policies, questionnaire responses, process documentation, and stakeholder updates. • Excellent attention to detail and project management discipline. • Experience responding to customer security questionnaires, RFP security sections, or due diligence requests. • Familiarity with GRC, compliance automation, or audit management tools. • Experience in SaaS, fintech, benefits, healthcare, or other regulated environments. • Comfort working in a startup or fast-moving environment where processes need to be mature enough to scale without creating unnecessary friction. • Ability to work with both technical and non-technical teams and communicate security and compliance expectations clearly. • Certifications such as CISA, CISM, CRISC, HITRUST CCSFP, ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, or Security+. • Experience supporting HITRUST readiness or validated assessments. • Experience with vendor risk management or third-party security assessments. • Experience supporting HIPAA, PCI DSS, GDPR, or other privacy and security frameworks. • Experience at a startup or high-growth technology company. • Familiarity with customer trust centers, security assurance portals, or reusable security response libraries.

Responsibilities

• Governance & Policy: Maintain and improve information security policies, standards, procedures, control documentation, and related governance materials. • Control Mapping: Help map policies and controls to frameworks such as SOC 2, ISO 27001/27002, HITRUST, NIST CSF 2.0, and other customer, regulatory, or security requirements. • Policy Operations: Support policy exceptions, risk acceptances, remediation tracking, control owner follow-ups, and recurring governance workflows. • Compliance & Audit Readiness: Support SOC 2, ISO 27001, and HITRUST readiness, audit preparation, evidence collection, auditor coordination, and audit response management. • Control Testing: Maintain recurring evidence-gathering and control testing workflows, helping ensure controls operate consistently across the business. • Findings & Remediation: Track audit findings, control gaps, remediation plans, owners, due dates, and closure evidence. • Risk Management: Support risk assessments, control gap assessments, internal reviews, and maintenance of the risk register. • Business Communication: Translate technical and security risks into clear business language, including mitigations, ownership, timelines, and residual risk. • Customer Assurance: Own or support customer security questionnaires, RFP security sections, due diligence requests, and trust or compliance documentation. • Response Libraries: Maintain reusable questionnaire content, approved responses, compliance artifacts, and customer-facing assurance materials. • Vendor Risk: Support vendor security reviews, third-party risk assessments, remediation tracking, risk acceptance documentation, and vendor compliance evidence. • Tooling & Process Improvement: Use GRC platforms such as Vanta, Drata, Thoropass, Secureframe, or similar tools to improve evidence collection, control monitoring, task tracking, reporting, and repeatable compliance operations.

Benefits

• $130,000-160,000 + Equity • RANGE(S) IS SUBJECT TO CHANGE. BENEPASS TAKES A NUMBER OF FACTORS INTO ACCOUNT WHEN DETERMINING INDIVIDUAL STARTING PAY, INCLUDING MARKET COMPARABLES, INTERVIEW PERFORMANCE, PEER COMPENSATION, AND YEARS OF EXPERIENCE. • 95% coverage of medical, dental, and vision • Fantastic benefits (of course 😃), including: • $250 WFH setup (one time) • $500/year Learning & Development Benefit • $150/month cell phone + internet • $100/month Wellness • $100/month Co-working and Commuter Benefit • At Benepass, we are working towards reimagining how companies take care of their people. We are committed to creating an inclusive environment for all our employees and are seeking to build a team that reflects the diversity of the people we hope to serve with our revolutionary products. Benepass is proud to be an equal-opportunity employer.