Cybersecurity GRC Analyst
At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.
About the Role
We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team runs the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers adopt our cloud products with confidence.
As our Cybersecurity GRC Analyst, you'll support the team across governance, risk, compliance, and customer trust work, and you'll own our annual security awareness training campaign. This is a hands-on, learning-focused role: you'll start with well-defined tasks and take on more complex work as you learn our programs.
We are a small team, so you'll get exposure to every part of GRC. In your first year, you'll gather audit evidence for SOC 2 and ISO 27001, answer customer security questionnaires, coordinate policy updates, and support our vendor risk and FedRAMP work. Experienced teammates review your work and are there to help when something is new or complex. You'll also have AI and GRC tooling, including Vanta, to help you work efficiently.
You'll succeed by being organized, responsive, and easy to work with, making it simpler for control owners to provide what audits and customers need.
+++No sponsorship will be provided for this role. Candidate must be eligible to work in the country in which you apply+++
What You Will Do
Security Awareness Training
Follow up on overdue security training, then lead the annual Security and Compliance Training campaign: work with People Operations and Legal on the curriculum, set up enrollments in the training platform, track completion weekly, and escalate overdue training.
Handle training exceptions, keep training records ready as audit evidence, and gather feedback to improve next year's campaign.
Customer Trust
Answer customer security questionnaires, starting with simpler requests and taking on more within your first few months. Escalate complex requests to senior teammates.
Check answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain our answer library and Trust Center content.
Audit and Compliance Support
Learn our FedRAMP program and support the FedRAMP ISSO as needed.
Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets each request, and prepare it for review before it goes to auditors.
Governance and Risk Support
Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records.
Recommend improvements to team processes, status reporting, and work priorities.
Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors.
Provide administrative support for the cyber risk register, including intake of new risk information.
Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection.
What You Will Bring (Required)
One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.
At least 6 months of experience in a GRC role.
Strong organization, attention to detail, and follow-through on deadlines.
Clear written and verbal communication skills.
Working knowledge of Microsoft 365 and Excel, and comfort using AI-assisted tools.
Preferred Qualifications
2 to 3 years of work experience in IT, cybersecurity, or GRC.
Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee.
Experience with a modern GRC platform such as Vanta.
Experience answering customer security questionnaires.
Experience at a SaaS, cloud, or cybersecurity company.
Success Measures (First Year)
Assignments are completed correctly and on time, with good judgment about when to ask for help.
Overdue training is followed up and the annual training campaign is delivered on schedule.
You share ownership of customer security questionnaires within your first few months.
Audit evidence for SOC 2 and ISO 27001 is complete and on time.
Why Join Us
You'll learn GRC across every domain alongside experienced GRC, security, and engineering professionals at a fast-growing cybersecurity company. As your skills grow, you can take on more complex customer trust, policy, risk, and FedRAMP work.
#LI-MR1
Why Join Semperis?
You’ll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you’re someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life—we’d love to meet you.
**Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days.
