Cybersecurity GRC Analyst

At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That's why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America's Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee. About the Role We protect some of the worlds largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers trust. Our GRC team runs the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers adopt our cloud products with confidence. As our Cybersecurity GRC Analyst, youll support the team across governance, risk, compliance, and customer trust work, and youll own our annual security awareness training campaign. This is a hands-on, learning-focused role: youll start with well-defined tasks and take on more complex work as you learn our programs. We are a small team, so youll get exposure to every part of GRC. In your first year, youll gather audit evidence for SOC 2 and ISO 27001, answer customer security questionnaires, coordinate policy updates, and support our vendor risk and FedRAMP work. Experienced teammates review your work and are there to help when something is new or complex. Youll also have AI and GRC tooling, including Vanta, to help you work efficiently. Youll succeed by being organized, responsive, and easy to work with, making it simpler for control owners to provide what audits and customers need. +++No sponsorship will be provided for this role. Candidate must be eligible to work in the country in which you apply+++ What You Will Do Security Awareness Training Follow up on overdue security training, then lead the annual Security and Compliance Training campaign: work with People Operations and Legal on the curriculum, set up enrollments in the training platform, track completion weekly, and escalate overdue training. Handle training exceptions, keep training records ready as audit evidence, and gather feedback to improve next years campaign. Customer Trust Answer customer security questionnaires, starting with simpler requests and taking on more within your first few months. Escalate complex requests to senior teammates. Check answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain our answer library and Trust Center content. Audit and Compliance Support Learn our FedRAMP program and support the FedRAMP ISSO as needed. Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets each request, and prepare it for review before it goes to auditors. Governance and Risk Support Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records. Recommend improvements to team processes, status reporting, and work priorities. Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors. Provide administrative support for the cyber risk register, including intake of new risk information. Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection. What You Will Bring (Required) One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity. At least 6 months of experience in a GRC role. Strong organization, attention to detail, and follow-through on deadlines. Clear written and verbal communication skills. Working knowledge of Microsoft 365 and Excel, and comfort using AI-assisted tools. Preferred Qualifications 2 to 3 years of work experience in IT, cybersecurity, or GRC. Exposure to SOC 2, ISO 27001, or FedRAMP audits, in a supporting role or as an auditee. Experience with a modern GRC platform such as Vanta. Experience answering customer security questionnaires. Experience at a SaaS, cloud, or cybersecurity company. Success Measures (First Year) Assignments are completed correctly and on time, with good judgment about when to ask for help. Overdue training is followed up and the annual training campaign is delivered on schedule. You share ownership of customer security questionnaires within your first few months. Audit evidence for SOC 2 and ISO 27001 is complete and on time. Why Join Us Youll learn GRC across every domain alongside experienced GRC, security, and engineering professionals at a fast-growing cybersecurity company. As your skills grow, you can take on more complex customer trust, policy, risk, and FedRAMP work. #LI-MR1 Why Join Semperis? You'll be part of a global team on the front lines of cybersecurity innovation. At Semperis, we celebrate curiosity, integrity, and people who take initiative. If you're someone who sees the glass as half full, embraces challenges as growth opportunities, and values a healthy balance between work and life-we'd love to meet you. Semperis maintains office locations in several cities across the globe. Where the job description specifies a required location, candidates will follow our hybrid work model. This includes working up to three days per week and remotely the remaining days. Semperis is an equal opportunity employer and will not discriminate against an applicant or employee based on race, color, religion, creed, national origin or ancestry, ethnicity, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran or military status, genetic information, citizenship, marital status, or any other legally recognized protected basis under federal, state, or local law. The information collected by the Semperis application is solely to determine suitability for employment, verify identity, and maintain employment statistics. Applicants with disabilities may be entitled to reasonable accommodation under the Americans with Disabilities Act and/or other applicable state or local laws. A reasonable accommodation is a change in the way things are normally done which will ensure an equal employment opportunity without imposing undue hardship on Semperis. Please inform Semperis representative Anna Taylor, Director of Global Recruiting, if you need assistance completing this application or to otherwise participate in the application process. Skills: Administrative Skills, Analysis Skills, Artificial Intelligence (AI), CISA - Certified Information Systems Auditor, CISSP - Certified Information Systems Security Professional, Campaigns, Cloud Computing, Communication Skills, Customer Acquisition, Detail Oriented, Follow Through, Government, ISO (International Organization for Standardization), Internet Security, Legal, Machine Tool, Microsoft Excel, Microsoft Product Family, Organizational Skills, Presentation/Verbal Skills, Risk, Security Policy, Software as a Service (SaaS), Startup, Time Management, Writing Skills Semperis Ltd