Senior GRC Analyst, Policy Operations

What you'll do

• Triage intake for new or updated security standards, policies, and control documents while assigning owners and timelines.
• Draft and finalize technical security standards in plain language by collaborating with internal subject matter experts.
• Manage the end-to-end review and approval cycle, including scheduling CAB reviews and tracking action items.
• Publish approved standards to the eGRC platform and retire outdated documentation.
• Ensure all internal controls are traceable to external regulatory requirements like SOC 2, ISO 27001, and FedRAMP.
• Perform regular content reviews to ensure every standard has a clear owner and current review date.
• Build and monitor dashboards to track the health, coverage, and adoption of security standards.
• Coordinate stakeholder communications including changelogs, engineering briefings, and internal updates.

What we're looking for

• Must have 3+ years of experience in security governance, GRC, technical writing, program management, or compliance operations at a software/product tech company.
• Must be a U.S. citizen or Permanent Resident.
• Must possess direct security-domain experience such as AppSec, cloud security, IAM, vulnerability management, or GRC-adjacent fields.
• Must have the ability to write clear standards and policies for non-security readers.
• Must have working knowledge of a major security/privacy framework like SOC 2, ISO 27001, NIST CSF, FedRAMP, PCI, HIPAA, or EU AI Act.
• Must be comfortable running cross-functional review cycles with senior stakeholders.
• Experience with Git, OSCAL, Markdown, and GRC platforms is required.
• CISA, CISM, CRISC, ISO 27001 Lead Implementer, or equivalent certifications are preferred.