GRC Associate (Contract)
About this role
This is a remote position.
About the Role:
We're looking for a part-time GRC Associate to do the day-to-day work of our governance, risk and compliance program. You'll own the deliverables: audit evidence, security questionnaire responses, the compliance calendar, and vendor reviews. You'll partner closely with our security engineers, Sales and Solutions Engineering. The Head of Security owns program strategy, risk decisions and policy sign-off.
What you'll do
Audit readiness (SOC 2 Type II, PCI DSS)
Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current
Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation
Run the biannual and quarterly PCI reviews and track external scan findings to closure
Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries
Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops
Customer trust and sales support
Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month). These include SIG, CAIQ and custom bank questionnaires, often submitted through customer portals such as LogicGate, Aravo and Coupa.
Keep the security answers current in the answer library that Solutions Engineering maintains. New or changed security claims get Security sign-off before they go out.
Build a reusable screenshot evidence pack for customers that won't accept Trust Center links
Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors
Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date
Policies, risk and governance
Run the annual review of our security policy set
Manage the security policy exceptions log
Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review
Coordinate the annual BCP/DR test and write the customer-facing summary
Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding
Third-party risk management
Run security assessments of internal-use and non-critical vendors. Support the Head of Security on critical vendor and subprocessor reviews, including annual reviews.
Keep the subprocessor list accurate and drive customer notifications when it changes
Run the intake and review process for new SaaS apps, OAuth apps, AI tools and MCP servers
Partner compliance and program structure
Handle day-to-day compliance work for our data-provider reseller agreements, starting with LexisNexis: customer credentialing, audit readiness and reporting
Build and run a compliance calendar of recurring controls, reviews, audits and renewals, with named owners
Send a monthly GRC status report to the Head of Security
What you'll bring
Must have
2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers
Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests
Has answered customer security questionnaires or DDQs
Clear writing: customer-facing answers should need only light review
Organized and persistent; you can track many small asks across teams and follow up without needing escalation
Nice to have
Hands-on experience with a compliance automation platform such as Drata, Vanta, Secureframe or OneTrust
Fintech, BaaS or banking-vendor experience
ISO 27001 experience
AI governance experience (NIST AI RMF, ISO 42001)
PCI DSS exposure; Security+, CISA or ISO 27001 Implementer
Engagement details
Hours:~20 hrs/week, flexible within the week. Volume is bursty around audit and questionnaire cycles.
Location:US Remote. Hours in US Pacific time, or a minimum of 4 hours overlap.
Contract:6-month initial term, renewable, with 30 days' notice to end. Hourly rate.
Onboarding:background check, NDA and security training. Access is through named accounts with least privilege (Drata, Notion, Slack, Google Workspace).
Work Location
This is a remote and hourly position.
Remote work is currently limited to candidates located in the following states:
AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA.
Compensation
Base:$50-$65/hour
We Offer
Competitive salary and pre-IPO equity
100% company-paid medical, dental, and vision insurance for employees
Unlimited PTO and generous leave programs
401(k)
Learning & development stipend
Home office setup support
A high-ownership, collaborative culture focused on impact, innovation, and growth
Equal Opportunity Employer
Unit21 is an equal opportunity employer. We encourage candidates to apply even if they don't meet every listed requirement. We are committed to building a diverse, inclusive workforce where everyone has the opportunity to thrive.
Originally posted on Himalayas
