At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc. 5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.

Location: Hybrid In-Office: Hoboken, NJ; Addison, TX; Phoenix, AZ; or Austin, TX

About the Role

We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team runs the policy, risk, compliance, and customer trust programs that let security-conscious enterprises, regulated industries, and government customers adopt Semperis products with confidence.

As our Senior GRC Analyst, you'll own three core programs: SOC/ISO/HIPAA Audits, customer security questionnaires and upkeep of our security policies and standards. You'll also be the day-to-day point of contact for remediation follow through on audit findings, and you'll support our FedRAMP work on occasion during certification phases.

We're a small team, so you'll back up teammates on vendor risk, risk exceptions, and our Trust Center when the queue gets heavy, and you'll be the person our GRC Analyst turns to for very complex questionnaires. You'll run your programs independently, bring recommendations to the Head of Risk and Compliance on scoping, policy, and higher-risk decisions, and get results through influence rather than authority.

You'll succeed by being accurate, organized, and persuasive with engineers and business owners who don't report to you. You'll have AI and GRC tooling, including Vanta, to help you work efficiently.

What You Will Do

Compliance

Work with the Head of Risk and Compliance for scoping and timing, then work with our PMO and Compliance consultants to prepare for, schedule, evidence, and execute on the fieldwork and reporting phases of the SOC2 Type II and ISO 27001 Audits. You’ll have support as needed from other team members.

Cover HIPAA Audits (Security and Breach Notification Rules) as part of our SOC and ISO work.

Support FedRAMP program and other frameworks as needed by researching control requirements, gathering evidence, reviewing deliverables, or producing documentation.

Take on internal audit, assurance testing, and due diligence work, including M&A, when assigned.

Customer Trust

Own customer, partner, and prospect security questionnaires and due diligence requests. Answer accurately and within SLA, working with Product and Engineering and/or FedRAMP SMEs to confirm answers.

Take on the very complex questionnaires our GRC Analyst escalates, and help the analyst grow in GRC areas that are new to them.

Build and maintain our reusable answer library using a mix of AI-assisted, automated, and manual processes.

Remediation Follow Through

Drive remediation dates with Engineering for non-FedRAMP audit findings: set recommended timelines, track milestones, and follow up with control owners.

Escalate blockers on high-risk items to the Head of Risk and Compliance or the CISO, and hold control owners to deadlines through clear communication and data, without formal authority over their teams.

Policy and Governance

Own the upkeep of our information security policies, standards, and procedures: draft updates and align them with frameworks such as NIST SP 800-53/CSF, ISO 27001:2022, HIPAA, and SOC 2.

Work with policy owners, People Operations, and Legal to get changes reviewed, approved, published, and acknowledged.

Stay current on regulatory, customer, and threat landscape changes, and recommend policy updates before they become audit findings.

Team Coverage and Continuous Improvement

Back up teammates on vendor risk assessments, risk exception reviews, and the commercial Trust Center when an owner is out or the queue is heavy.