# GRC Analyst

**Company**: Vercel
**Location**: Hybrid - San Francisco, New York City, London
**Work arrangement**: hybrid
**Experience**: senior
**Job type**: full-time
**Salary**: $134,000-$202,000
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/vercel/jobs/6102654004?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_d6e29924-ef8

## Description

We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI. As a GRC Analyst at Vercel, you will assess AI tools and vendors against security, privacy, and compliance requirements. You will maintain internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance. You will also use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses.

Responsibilities:

- Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training

- Maintain internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress

- Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores

- Manage annual audit deliverables, write treatment plans, and track completion across teams

- Answer customer compliance inquiries and maintain customer-facing security and compliance documentation

Requirements:

- 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment

- Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review

- Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners

- Led compliance projects across multiple business units and seniority levels

Nice to have:

- Built an automation or internal tool, with code or AI coding tools, even outside an engineering role

- Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework

- Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification

Compensation & Benefits:

- Competitive compensation package, including equity

- Inclusive Healthcare Package

- Learn and Grow - we provide mentorship and send you to events that help you build your network and skills

- Flexible Time Off

- We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed

The San Francisco, CA base pay range for this role is $134,000-$202,000. Actual salary will be based on job-related skills, experience, and location.

## Skills

### Required
- ISO 27001
- SOC 2
- HIPAA
- PCI DSS
- AI tooling
- security policies
- compliance projects

### Nice to have
- ISO/IEC 42001
- NIST AI Risk Management Framework
- CISM
- CISSP
- CCEP

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/vercel/jobs/6102654004?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)