Senior GRC Analyst (SaaS)

Location: Remote within the United States. Applicants must be authorized to work for any employer in the U.S.; employment visa sponsorship is not available.

Target annual compensation: $175,000–$190,000.

Company

Tines is an intelligent workflow and SaaS company providing a secure, vendor-agnostic automation platform for IT and security teams.

What you will do

• Drive end-to-end audit cycles for SOC 2 Type II and ISO 27001, 27701, and 42001, including evidence collection, control testing, auditor liaison, and remediation tracking.
• Support FedRAMP gap analysis, remediation planning, documentation, and coordination with 3PAO assessors.
• Operate continuous control monitoring, including scan and penetration-test reporting, control drift detection, and evidence freshness.
• Conduct vendor security assessments and risk analyses for systems, processes, and third-party applications.
• Respond to customer security questionnaires and audit requests, support Sales with RFPs and RFQs, and maintain Trust Center documentation.
• Automate compliance workflows with Tines, maintain security policies, review contracts, monitor regulations, and collaborate with Engineering, Product, IT, Legal, HR, and leadership.

Requirements

• 8–12 years of experience in IT compliance, security, or risk management.
• Hands-on experience with ISO 27001, SOC 2 evidence collection and control testing, and FedRAMP certification processes.
• Experience conducting vendor security assessments, risk analyses, continuous monitoring, and compliance reporting.
• Strong knowledge of information security principles, controls, cloud security across AWS, Azure, or GCP, and privacy regulations including GDPR and CCPA.
• Strong project management and communication skills, including translating technical requirements for non-technical stakeholders.
• U.S. work authorization is required; employment visa sponsorship is unavailable.

Nice to have

• Previous audit-side experience at a 3PAO or audit firm, or experience driving certification-readiness remediation.
• CISSP, CISA, or CISM certification.
• Compliance automation, scripting, or API experience for evidence automation.
• Experience reviewing contracts for security and compliance requirements.
• Experience in SaaS or technology companies and remote-first environments.

Culture & Benefits

• Remote-first work environment.
• Values centered on Simplicity, Speed, and Soundness.
• Culture supporting curiosity, growth, integrity, and diverse perspectives.
• Opportunity to use the Tines platform to reduce manual compliance work.