Senior Governance, Risk & Compliance Analyst
Requirements
- 5–9 years in GRC, security compliance, or risk within SaaS/cloud environments,
- Direct ownership of SOC 2 and/or ISO 27001 audits,
- Experience managing control frameworks and audit evidence lifecycle,
- Strong understanding of risk assessment methodologies,
- Proven ability to drive remediation across cross-functional teams,
- (Desirable) Experience with third-party risk programs,
- (Desirable) Familiarity with GRC tools (Vanta, Drata, LogicGate, OneTrust),
- (Desirable) Experience in high-growth SaaS or PE-backed environments,
- (Desirable) Certifications: CISA, CISM, CISSP, CRISC, ISO 27001 Lead,
- (Desirable) Experience scaling GRC programs or implementing automation,
- (Desirable) Exposure to HIPAA, GDPR, or NIST frameworks,
- 5–9 years total experience,
- 2+ years directly owning audits or compliance programs,
- Experience operating in environments with multiple concurrent audits
What the job involves
- Nasuni is seeking a Senior GRC Analyst to strengthen and scale our governance, risk, and compliance programs across a fast-growing, AI-ready SaaS platform. This role owns critical audit, risk, and policy initiatives that directly impact customer trust, regulatory posture, and business scalability,
- You’ll operate at the intersection of security, engineering, legal, and operations—ensuring our controls are effective, auditable, and continuously improving,
- This role is ideal for someone who has led audit and risk programs end-to-end, not just supported them, and who is motivated to modernize GRC through automation and intelligent tooling,
- Owns execution and continuous improvement of core GRC programs,
- Operates independently across multiple compliance frameworks,
- Influences cross-functional stakeholders without direct authority,
- Balances execution (audits, controls) with program optimization,
- Contributes to scalable, automation-driven GRC operations,
- Lead SOC 1, SOC 2, ISO 27001 audits end-to-end (planning → evidence → remediation),
- Partner with auditors and internal teams to ensure timely, accurate audit delivery,
- Track and drive remediation of control gaps with accountable owners,
- Own lifecycle of security policies, standards, and control documentation,
- Align policies to evolving regulatory and business requirements,
- Facilitate cross-functional policy reviews and approvals,
- Conduct enterprise risk assessments and maintain risk register,
- Partner with business leaders to prioritize and mitigate risk,
- Deliver risk insights and reporting to leadership for decision-making,
- Own vendor risk assessments, onboarding, and periodic reviews,
- Build scalable due diligence and monitoring processes,
- Partner with procurement and legal on vendor risk decisions,
- Lead security awareness and training programs (phishing, compliance training),
- Measure effectiveness and continuously improve engagement,
- Manage GRC platforms (e.g., Vanta, Drata, OneTrust),
- Identify and implement automation opportunities in evidence collection, risk tracking, and reporting,
- Leverage AI tools to improve control monitoring, audit readiness, and workflow efficiency