GRC Analyst (Cybersecurity)

Location: Remote - US; standard working hours are 8am-5pm Central Time. Minimal travel may be required.

Base salary: $90,000-$110,000 per year, excluding fringe benefits and potential bonuses.

Company

hirify.global provides cloud-based employee benefits administration technology and services for companies, employees, and HR teams.

What you will do

• Manage client assurance requests, including security questionnaires, due diligence inquiries, RFP security sections, SOC reports, bridge letters, and penetration testing summaries.
• Partner with Sales, Client Experience, Legal, Product, and Information Security to prepare accurate and defensible customer responses.
• Support SOC 2 and other audits by coordinating evidence requests and maintaining audit-ready control documentation.
• Execute recurring user access reviews, validate least-privilege access, and track remediation of exceptions.
• Support reviews of customer security addenda, contract language, and redlined security requirements.
• Improve GRC processes, documentation, automation, reporting, and reusable security response content.

Requirements

• Bachelor’s degree in Cybersecurity, Information Systems, Business Administration, Risk Management, Accounting, or a related field, or equivalent education and experience.
• 2 or more years of experience in information security, IT audit, GRC, security compliance, client assurance, or a related discipline.
• Working knowledge of SOC 2, access management, least privilege, segregation of duties, disaster recovery, data protection, security testing, and controls.
• Experience interpreting questionnaires, gathering stakeholder information, and preparing professional responses.
• Strong written communication, analytical, organizational, documentation, and follow-up skills.
• Ability to work remotely from the US and align with 8am-5pm Central Time working hours.

Nice to have

• Experience with customer security questionnaires, due diligence requests, RFP security sections, SOC 2 audits, IT audits, or compliance assessments.
• Experience administering access certification or user access review programs.
• Experience reviewing security contract language and security addenda with Legal teams.
• Familiarity with SecurityPal, Archer, OneTrust, MetricStream, or similar GRC platforms.
• Certifications such as CISA, CRISC, Security+, or CISSP, or experience in SaaS, healthcare technology, benefits administration, or financial services.

Culture & Benefits

• Remote-first, office-friendly work environment.
• Health, dental, and vision plans.
• Employer-sponsored retirement savings programs.
• Professional development, training, and career growth opportunities.
• Collaborative, inclusive culture with wellbeing, mental health, and financial planning initiatives.