Senior Governance, Risk, and Compliance (GRC) Analyst (Remote)

Team: Technology

Location: Orem, UT

Commitment: Full Time

Workplace Type: remote

Key Responsibilities:

Lead RainFocus's GRC program across SOC 2, ISO 27001, PCI DSS, and other client/regulatory compliance frameworks, including audit prep, evidence collection, and auditor relationships.
 
Manage and mature our control framework, mapping new regulations and conducting gap assessments.
 
Own the annual security risk assessment process (NIST SP 800-30 methodology), including stakeholder interviews, risk scoring, and residual risk tracking.
 
Maintain and update security policies, standards, and documentation to ensure compliance with industry best practices.
 
Partner with Engineering and Security to mature vulnerability management and secrets-scanning practices, moving these from reactive to proactive, pre-deployment controls.
 
Help build out and operationalize a Data Loss Prevention (DLP) program, including policy design and rollout across email, endpoint, and cloud storage.
 
Grow and mature RainFocus's security awareness training program.
 
Drive AI governance efforts — policy, tooling, and monitoring for approved vs. unapproved AI tool usage across the company.
 
Identify and help close Shadow IT / unmanaged SaaS visibility gaps in partnership with IT.
 
Collaborate with cross-functional teams to implement risk management practices and ensure compliance across the organization.
 
Respond to security and privacy inquiries from clients, partners, and employees.
 
Prepare and present reports on the organization's security and privacy compliance status, including program maturity and remediation progress.
Stay abreast of emerging security threats, vulnerabilities, and compliance requirements.

Qualifications:

Bachelor's degree in Technology, Cybersecurity, or a related field is highly desirable.

6+ years of proven experience in GRC, IT audit, information security compliance, or a related field.

In-depth knowledge of relevant regulations, standards, and frameworks (e.g., SOC 2, ISO 27001, PCI DSS, NIST 800-series, GDPR, and others).

Experience running or contributing heavily to formal risk assessments — not just tracking a compliance checklist.

Professional certifications such as CISA, CRISC, CISSP, CIPP, or CIPM are highly desirable.

Familiarity with modern security tooling such as Drata, OneTrust, Vanta, etc.

Strong analytical and problem-solving skills, with keen attention to detail.

Excellent communication and interpersonal skills to work effectively with technical and non-technical stakeholders.

Ability to manage multiple projects and meet deadlines in a fast-paced environment.

Experience with cloud security and compliance frameworks is a plus.

Experience with OneTrust or related GRC technologies is a plus.

Personal Characteristics:

Strong work ethic and commitment to excellence.

Ability to work independently and as part of a team.

Excellent problem-solving and analytical skills.

Strong communication and interpersonal skills.

Ability to adapt to change and learn quickly.

Passion for security and privacy.