Cybersecurity GRC Analyst

At Semperis, our mission is to be a Force for Good. Starting with being a great place to work. We believe that when people feel valued, supported, and empowered, they do their best work. That’s why we focus on creating an employee experience rooted in purpose, growth, and balance. Semperis has been recognized as one of America’s Fastest-Growing Cybersecurity Companies by the Inc.

5000, a DUNS 100 Top Startup to Work For, and a multi-year Inc. Best Workplace awardee.

About the Role

We protect some of the world's largest, most complex hybrid identity environments, and that mission depends on earning and keeping our customers' trust. Our GRC team runs the certification and audit programs that let security-conscious enterprises, regulated industries, and government customers adopt our cloud products with confidence.

As our Cybersecurity GRC Analyst, you'll support the team across governance, risk, compliance, and customer trust work, and you'll own our annual security awareness training campaign. This is a hands-on, learning-focused role: you'll start with well-defined tasks and take on more complex work as you learn our programs.

We are a small team, so you'll get exposure to every part of GRC. In your first year, you'll gather audit evidence for SOC 2 and ISO 27001, answer customer security questionnaires, coordinate policy updates, and support our vendor risk and FedRAMP work. Experienced teammates review your work and are there to help when something is new or complex. You'll also have AI and GRC tooling, including Vanta, to help you work efficiently.

You'll succeed by being organized, responsive, and easy to work with, making it simpler for control owners to provide what audits and customers need.

+++No sponsorship will be provided for this role. Candidate must be eligible to work in the country in which you apply+++

What You Will Do

Security Awareness Training

• Follow up on overdue security training, then lead the annual Security and Compliance Training campaign: work with People Operations and Legal on the curriculum, set up enrollments in the training platform, track completion weekly, and escalated overdue training.

• Handle training exceptions, keep training records ready as audit evidence, and gather feedback to improve next year's campaign.

Customer Trust

• Answer customer security questionnaires, starting with simpler requests and taking on more within your first few months. Escalate complex requests to senior teammates.

• Check answers for accuracy, confirm requestors are under NDA before sharing information, and help maintain our answer library and Trust Center content.

Audit and Compliance Support

• Learn our FedRAMP program and support the FedRAMP ISSO as needed.

• Gather and organize evidence for SOC 2 and ISO 27001 audits, confirm it meets each request, and prepare it for review before it goes to auditors.

Governance and Risk Support

• Coordinate security policy updates: route policies for review and approval, publish approved versions, and keep version history and change records.

• Recommend improvements to team processes, status reporting, and work priorities.

• Support vendor risk work by tracking annual recertification of critical vendors and sending information requests to vendors.

• Provide administrative support for the cyber risk register, including intake of new risk information.

• Use our GRC platform (Vanta) and help find ways to automate manual tasks and evidence collection.

What You Will Bring (Required)

• One of the following: a CISA, CRISC, or CISSP certification, or a degree in Cybersecurity.

• At least 6 months of experience in a GRC role.

• Strong organization, attention to detail, and follow-through on deadlines.

• Clear written and verbal communication skills.

• Working knowledge of Microsoft 365 and…