Senior GRC Analyst, Security

1 Month ago • 3 Years +
Cyber Security

Job Description

Ethos is seeking a Senior GRC Analyst to support information security governance, risk, and compliance activities. This role involves developing and maintaining security policies, conducting risk assessments, ensuring regulatory compliance (ISO 27001, SOC2, NIST, PCI-DSS, CCPA, NYDFS, HIPAA), and managing vendor risks. The ideal candidate will have 3+ years of experience in information security, strong knowledge of frameworks, and expertise in TPRM and security audits.
Good To Have:
  • Relevant certifications such as ISO 27001 LA LI, CISA, CRISC.
Must Have:
  • Support information security governance, risk, and compliance activities.
  • Develop, implement, and maintain information security policies and procedures.
  • Conduct information security risk assessments and evaluate existing controls.
  • Identify, assess, and document information security & privacy risks.
  • Conduct regular risk assessments for existing and potential vendors.
  • Ensure compliance with ISO 27001, SOC2, ITGC, NIST, PCI-DSS, CCPA, NYDFS, HIPAA.
  • Conduct regular security compliance assessments and audits.
  • Maintain comprehensive documentation for GRC.
  • Prepare and present GRC reports to senior management.
  • 3+ years experience in information security, risk management and compliance.
  • Strong knowledge of information security frameworks, standards, and regulations.
  • Experience with security & privacy risk assessment and management methodologies.
  • Extensive experience in Third Party/Vendor Risk Management (TPRM).
  • Hands-on expertise in managing VRM tools (e.g., OneTrust, ProcessUnity, Vanta).
  • Experience in supporting security audits (SOC2, Customer & Partners Audits), at least 2 complete SOC2 audit cycles.

Add these skills to join the top 1% applicants for this job

communication
risk-management
risk-assessment
game-texts
data-science

About Ethos

Ethos was built to make it faster and easier to get life insurance for the next million families. Our approach blends industry expertise, technology, and the human touch to find you the right policy to protect your loved ones.

We leverage deep technology and data science to streamline the life insurance process, making it more accessible and convenient. Using predictive analytics, we are able to transform a traditionally multi-week process into a modern digital experience for our users that can take just minutes! We’ve issued billions in coverage each month and eliminated the traditional barriers, ushering the industry into the modern age. Our full-stack technology platform is the backbone of family financial health.

We make getting life insurance easier, faster and better for everyone.

Our investors include General Catalyst, Sequoia Capital, Accel Partners, Google Ventures, SoftBank, and the investment vehicles of Jay-Z, Kevin Durant, Robert Downey Jr and others. This year, we were named on CB Insights' Global Insurtech 50 list and BuiltIn's Top 100 Midsize Companies in San Francisco. We are scaling quickly and looking for passionate people to protect the next million families!

About the Role

The GRC Analyst is responsible for supporting the organization's information security governance, risk, and compliance activities. This role involves ensuring that the organization’s security policies, procedures, and practices are aligned with regulatory requirements, industry standards, and best practices. The ideal candidate will have a strong understanding of information Security & Privacy principles, Third Party Vendor Risk management, ITGC & SOC2 audit controls, and the ability to communicate complex security issues to various stakeholders.

Duties and Responsibilities:

1. Governance:

  • Develop, implement, and maintain information security policies and procedures.
  • Ensure alignment of security governance frameworks with business objectives and regulatory requirements.
  • Assist in the creation and maintenance of the information security governance structure.

3. Risk Management:

  • Conduct information security risk assessments and evaluate the effectiveness of existing controls.
  • Identify, assess, and document risks related to information security & privacy across the organization.
  • Conduct regular risk assessments for existing and potential vendors.
  • Monitor and report on the organization’s information security risk posture.

5. Compliance:

  • Ensure compliance with relevant information security regulations, standards, and frameworks (e.g., ISO 27001, SOC2, ITGC, NIST, PCI-DSS, CCPA, NYDFS, HIPAA).
  • Conduct regular security compliance assessments and audits.
  • Track and report on compliance gaps and work with relevant teams to address deficiencies.
  • Stay current on emerging security regulations and industry best practices.
  • Develop and deliver information security awareness and training programs to staff at all levels.

7. Reporting and Documentation:

  • Maintain comprehensive and accurate documentation related to information security governance, risk, and compliance.
  • Prepare and present reports on the organization’s information security activities, risk assessments, and compliance status to senior management.
  • Ensure all documentation is up-to-date and in compliance with regulatory and organizational requirements.

Qualifications and Skills:

  • Bachelor’s degree in Information Security, Computer Science, Cybersecurity, or a related field.
  • 3+ years of experience in information security, risk management and compliance.
  • Strong knowledge of information security frameworks, standards, and regulations (e.g., ISO 27001, NIST, CCPA, PCI-DSS, NYDFS, HIPAA).
  • Experience with security & privacy risk assessment and management methodologies.
  • Extensive experience in Third Party/Vendor Risk Management (TPRM) with hands-on expertise in managing VRM tools (e.g.,OneTrust, ProcessUnity, Vanta).
  • Experience in supporting security audits (SOC2, Customer & Partners Audits) - At least 2 complete audit cycles of SOC2.
  • Excellent communication skills, with the ability to convey complex security concepts to non-technical stakeholders.
  • Relevant certifications such as ISO 27001 LA LI, CISA, CRISC are highly desirable.

#LI-Hybrid

Don’t meet every single requirement? If you’re excited about this role but your past experience doesn’t align perfectly with every qualification in the job description, we encourage you to apply anyway. At Ethos we are dedicated to building a diverse, inclusive and authentic workplace.

We are an equal opportunity employer who values diversity and inclusion and look for applicants who understand, embrace and thrive in a multicultural world. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. Pursuant to the SF Fair Chance Ordinance, we will consider employment for qualified applicants with arrests and conviction records.

To learn more about what information we collect and how it may be used, please refer to our California Candidate Privacy Notice.

Set alerts for more jobs like Senior GRC Analyst, Security
Set alerts for new jobs by Ethos Life
Set alerts for new Cyber Security jobs in India
Set alerts for new jobs in India
Set alerts for Cyber Security (Remote) jobs

Contact Us
hello@outscal.com
Made in INDIA 💛💙