Senior Governance, Risk & Compliance Analyst

Requirements • 5–9 years in GRC, security compliance, or risk within SaaS/cloud environments, • Direct ownership of SOC 2 and/or ISO 27001 audits, • Experience managing control frameworks and audit evidence lifecycle, • Strong understanding of risk assessment methodologies, • Proven ability to drive remediation across cross-functional teams, • (Desirable) Experience with third-party risk programs, • (Desirable) Familiarity with GRC tools (Vanta, Drata, LogicGate, OneTrust), • (Desirable) Experience in high-growth SaaS or PE-backed environments, • (Desirable) Certifications: CISA, CISM, CISSP, CRISC, ISO 27001 Lead, • (Desirable) Experience scaling GRC programs or implementing automation, • (Desirable) Exposure to HIPAA, GDPR, or NIST frameworks, • 5–9 years total experience, • 2+ years directly owning audits or compliance programs, • Experience operating in environments with multiple concurrent audits What the job involves • Nasuni is seeking a Senior GRC Analyst to strengthen and scale our governance, risk, and compliance programs across a fast-growing, AI-ready SaaS platform. This role owns critical audit, risk, and policy initiatives that directly impact customer trust, regulatory posture, and business scalability, • You’ll operate at the intersection of security, engineering, legal, and operations—ensuring our controls are effective, auditable, and continuously improving, • This role is ideal for someone who has led audit and risk programs end-to-end, not just supported them, and who is motivated to modernize GRC through automation and intelligent tooling, • Owns execution and continuous improvement of core GRC programs, • Operates independently across multiple compliance frameworks, • Influences cross-functional stakeholders without direct authority, • Balances execution (audits, controls) with program optimization, • Contributes to scalable, automation-driven GRC operations, • Lead SOC 1, SOC 2, ISO 27001 audits end-to-end (planning → evidence → remediation), • Partner with auditors and internal teams to ensure timely, accurate audit delivery, • Track and drive remediation of control gaps with accountable owners, • Own lifecycle of security policies, standards, and control documentation, • Align policies to evolving regulatory and business requirements, • Facilitate cross-functional policy reviews and approvals, • Conduct enterprise risk assessments and maintain risk register, • Partner with business leaders to prioritize and mitigate risk, • Deliver risk insights and reporting to leadership for decision-making, • Own vendor risk assessments, onboarding, and periodic reviews, • Build scalable due diligence and monitoring processes, • Partner with procurement and legal on vendor risk decisions, • Lead security awareness and training programs (phishing, compliance training), • Measure effectiveness and continuously improve engagement, • Manage GRC platforms (e.g., Vanta, Drata, OneTrust), • Identify and implement automation opportunities in evidence collection, risk tracking, and reporting, • Leverage AI tools to improve control monitoring, audit readiness, and workflow efficiency