Senior GRC Analyst, Common Control Framework

What you'll do

• Map common controls to applicable frameworks, standards, and certification requirements to identify reuse opportunities.
• Maintain and update control documentation including descriptions, mappings, applicability, and implementation guidance throughout their lifecycle.
• Analyze certification requirements to determine control coverage and streamline assessment processes and timelines.
• Research emerging regulations and standards to evaluate potential impacts on the Common Controls Framework.
• Identify and implement compliance automation opportunities to reduce the overall burden on the organization.
• Develop and maintain reporting, metrics, and analyses regarding CCF adoption and certification readiness.
• Track control gaps and inconsistencies while escalating critical issues to senior team members.
• Utilize AI and generative-AI tools to enhance CCF processes, data management, and stakeholder engagement.

What we're looking for

• 3+ years of experience in security governance, GRC, technical writing, program management, or compliance operations at a tech company.
• Direct security-domain experience in areas such as application security, cloud security, IAM, vulnerability management, or GRC-adjacent fields.
• Ability to write clear, concise standards, policies, or procedures for non-security readers.
• Working knowledge of a major security/privacy framework like SOC 2, ISO 27001, NIST CSF, FedRAMP, PCI, HIPAA, or the EU AI Act.
• Experience with a GRC platform such as Salesforce eGRC, ServiceNow GRC, Archer, OneTrust, LogicGate, or similar.
• Ability to run cross-functional review cycles with senior stakeholders in Engineering, Legal, Privacy, and Product.
• Experience at a cloud, SaaS, or platform company under multiple concurrent audit regimes (preferred).
• CISA, CISM, CRISC, ISO 27001 Lead Implementer, or equivalent certification (preferred).