GRC Associate (Contract)

This is a remote position.

About the Role:

We're looking for a part-time GRC Associate to do the day-to-day work of our governance, risk and compliance program. You'll own the deliverables: audit evidence, security questionnaire responses, the compliance calendar, and vendor reviews. You'll partner closely with our security engineers, Sales and Solutions Engineering. The Head of Security owns program strategy, risk decisions and policy sign-off.

What you'll do

Audit readiness (SOC 2 Type II, PCI DSS)

-

Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current

-

Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation

-

Run the biannual and quarterly PCI reviews and track external scan findings to closure

-

Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries

-

Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops

Customer trust and sales support

-

Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month). These include SIG, CAIQ and custom bank questionnaires, often submitted through customer portals such as LogicGate, Aravo and Coupa.

-

Keep the security answers current in the answer library that Solutions Engineering maintains. New or changed security claims get Security sign-off before they go out.

-

Build a reusable screenshot evidence pack for customers that won't accept Trust Center links

-

Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors

-

Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date

Policies, risk and governance

-

Run the annual review of our security policy set

-

Manage the security policy exceptions log

-

Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review

-

Coordinate the annual BCP/DR test and write the customer-facing summary

-

Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding

Third-party risk management

-

Run security assessments of internal-use and non-critical vendors. Support the Head of Security on critical vendor and subprocessor reviews, including annual reviews.

-

Keep the subprocessor list accurate and drive customer notifications when it changes

-

Run the intake and review process for new SaaS apps, OAuth apps, AI tools and MCP servers

Partner compliance and program structure

-

Handle day-to-day compliance work for our data-provider reseller agreements, starting with LexisNexis: customer credentialing, audit readiness and reporting

-

Build and run a compliance calendar of recurring controls, reviews, audits and renewals, with named owners

-

Send a monthly GRC status report to the Head of Security

What you'll bring

Must have

-

2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers

-

Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests

-

Has answered customer security questionnaires or DDQs

-

Clear writing: customer-facing answers should need only light review

-

Organized and persistent; you can track many small asks across teams and follow up without needing escalation

Nice to have

-

Hands-on experience with a compliance automation platform such as Drata, Vanta, Secureframe or OneTrust

-

Fintech, BaaS or banking-vendor experience

-

ISO 27001 experience

-

AI governance experience (NIST AI RMF, ISO 42001)

-

PCI DSS exposure; Security+, CISA or ISO 27001 Implementer

Engagement details

-

Hours:~20 hrs/week, flexible within the week. Volume is bursty around audit and questionnaire cycles.

-

Location:US Remote. Hours in US Pacific time, or a minimum of 4 hours overlap.

-

Contract:6-month initial term, renewable, with 30 days' notice to end. Hourly rate.

-

Onboarding:background check, NDA and security training. Access is through named accounts with least privilege (Drata, Notion, Slack, Google Workspace).

Work Location

This is a remote and hourly position.

Remote work is currently limited to candidates located in the following states:

AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA.

Compensation

Base:$50-$65/hour

We Offer

-

Competitive salary and pre-IPO equity

-

100% company-paid medical, dental, and vision insurance for employees

-

Unlimited PTO and generous leave programs

-

401(k)

-

Learning & development stipend

-

Home office setup support

-

A high-ownership, collaborative culture focused on impact, innovation, and growth

Originally posted on Himalayas