Senior Governance, Risk and Compliance Analyst

Our client, a fast-growing enterprise SaaS company, is hiring a Senior Governance, Risk and Compliance (GRC) Analyst to own and mature its GRC program. You will report directly to the CISO, lead audits and risk assessments across SOC 2, ISO 27001 and PCI DSS, and move the program from maintaining the status quo to proactive, pre-deployment controls, including AI governance and data loss prevention.

• Lead the GRC program across SOC 2, ISO 27001, PCI DSS and customer and regulatory frameworks, including audit preparation, evidence collection and auditor relationships.
• Manage and mature the control framework, map new regulations and run gap assessments.
• Own the annual security risk assessment (NIST SP 800-30): stakeholder interviews, risk scoring and residual risk tracking.
• Maintain security policies, standards and documentation.
• Partner with Engineering and Security to move vulnerability management and secrets scanning from reactive to proactive controls.
• Help build and roll out a Data Loss Prevention program across email, endpoint and cloud storage.
• Grow the security awareness training program.
• Drive AI governance: policy, tooling and monitoring of approved and unapproved AI tool use.
• Close Shadow IT and unmanaged SaaS visibility gaps with IT.
• Answer security and privacy questions from customers and partners, and report program status and remediation progress to leadership.

• 6+ years in GRC, IT audit, information security compliance or a related field.
• In-depth knowledge of SOC 2, ISO 27001, PCI DSS, the NIST 800 series and GDPR.
• Experience running formal risk assessments, not just tracking a compliance checklist.
• Familiarity with modern GRC tooling such as Drata, Vanta or OneTrust.
• Strong analytical skills and clear communication with technical and non-technical stakeholders.
• Ability to manage several projects and deadlines in a fast-paced environment.
• Bachelor's degree in technology, cybersecurity or a related field is highly desirable.

• CISA, CRISC, CISSP, CIPP or CIPM.
• Cloud security and cloud compliance experience.
• Hands-on OneTrust or similar GRC platform administration.

• A direct line to the hiring team. BLUU KAZI presents your profile in person, so your application never disappears into a portal.
• Coaching at every stage. Interview preparation, feedback after each round and support through the offer.
• Room to grow. Access to BLUU KAZI training and certification paths in cybersecurity, cloud and AI.
• A bench that works for you. Join our network of emerging and veteran technologists and hear first about roles that fit.