The Challenge

We are looking for a dynamic Information Security GRC Analyst to support IT and InfoSec by performing various governance, risk, and compliance activities as part of the OneTrust InfoSec GRC team.

Your mission

• Customer Security Assurance & Questionnaires
  
  
• • Own a high volume of end-to-end completion of customer security questionnaires (CAQs), RFP security sections, and other assurance artifacts (e.g., SIG, CAIQ, custom questionnaires).

  • Provide accurate, consistent, and defensible responses by leveraging internal evidence repositories (SOC reports, ISO certificates, policies, standards, diagrams, pen test summaries, etc.).

  • Partner with internal stakeholders (Sales, Marketing, Customer Success, Security, Engineering, Privacy, Legal, Compliance, Product) to validate responses and resolve gaps.

• Customer Engagement & Security Discussions

  • Meet with customers and prospects to explain security controls, risk posture, and compliance commitments.

  • Present security topics with confidence and clarity—tailoring depth for technical and non-technical audiences.

  • Support Sales and Customer Success by addressing security objections, clarifying customer audit scope, and enabling procurement cycles.

• Contract & Security Review

  • Perform security reviews of contracts, DPAs, security addenda, and customer security terms.

  • Identify security requirements, non-standard obligations, and risk areas; propose mitigations and collaborate with Legal and Security leadership on negotiation positions.

  • Track contractual security commitments and help ensure they are operationally feasible and aligned with control coverage.

• Operational Excellence

  • Improve team efficiency through standardization, playbooks, and continuous refinement of response libraries.

  • Demonstrated ability to manage, prioritize, and execute a high volume of concurrent requests with accuracy and consistency, while meeting SLAs and maintaining quality standards in a fast-paced environment.

  • Contribute to internal readiness by keeping evidence current, identifying control documentation gaps, and recommending process improvements.

You Are

• • 2-5 years of relevant experience in information security, security compliance, GRC, security assurance, third-party risk, or customer trust functions.

  • Demonstrated experience responding to customer security questionnaires and security due diligence requests.

  • Familiarity with common frameworks and attestations: SOC 2, ISO 27001, NIST, CIS, PCI DSS, HIPAA, GDPR, etc.

  • Strong understanding of security fundamentals (e.g., access control, encryption, vulnerability management, secure SDLC, incident response, logging/monitoring, vendor risk).

  • Experience collaborating cross-functionally (Security, Legal, Privacy, Engineering, Sales).

  • Excellent written and verbal communication skills—able to translate technical controls into clear, customer-ready responses.

  • Strong organizational skills and ability to manage multiple requests with competing deadlines.

• Preferred / Nice-to-Have

  • Industry certifications such as CISA and/or CISM (or equivalent).

  • Experience reviewing/negotiating security contract terms, security addendums, and customer assurance language.

  • Background in SaaS/cloud security assurance or supporting enterprise customers.

• Core Competencies

  • Customer-oriented mindset with the ability to maintain security rigor while enabling business outcomes.

  • Risk-based thinking—knows when to escalate, when to propose mitigations, and how to document decisions.

  • Attention to detail and commitment to consistency, defensibility, and evidence-based responses.

  • Comfort with ambiguity and strong ability to drive outcomes in a fast-paced environment.

  • High-Throughput Execution – Ability to efficiently manage and deliver a high volume of security assurance requests while maintaining quality, accuracy, and timeliness.

• What Success Looks Like (First 90 Days)

  • Independently handles a steady volume of questionnaires with high accuracy and improved cycle times.

  • Builds trusted partnerships with Legal/Privacy/Security to streamline approvals and escalations.

  • Leads customer security calls effectively and contributes to deal progression.

  • Establishes reusable response patterns and mentors junior staff to raise overall team quality.