Senior GRC Analyst - Central or Eastern time, US or Canada
Core
Develop, maintain, and assess an integrated security and privacy management framework for an AI platform serving the insurance industry.
Role type
Senior GRC Analyst (Information Security)
Builds
Security assurance plans, compliance documentation, audit evidence, and third-party risk assessments.
Domain
Insurance / Information Security / GRC
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
GRC frameworks (ISO 27001, SOC 2, NIST CSF), privacy regulations (GDPR, HIPAA), audit management, third-party risk assessment, GRC tooling (Drata), risk analysis
Preferred skills
CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, CISSP, AI regulations (EU AI Act, ISO 42001)
Technologies
Drata, ISO 27001, SOC 2 Type II, HITRUST, NIST CSF, GDPR, HIPAA, EU AI Act, ISO 42001
Responsibilities
Translate global security expectations into actionable policies and procedures; manage internal and external audits for certifications; lead risk assessments and third-party security assurance; support TrustOps efforts for contract reviews and due diligence; facilitate Data Protection Impact Assessments (DPIAs); coordinate remediation of audit findings.
Seniority
Senior, hands-on IC