[Remote] IT GRC Analyst

Note: The job is a remote job and is open to candidates in USA. Cloud for Good is a client-service organization seeking an IT GRC Analyst to operate its security compliance program. The role coordinates penetration testing vendors and SOC 2 audits, manages security questionnaires, maintains policies and risk documentation, and drives remediation of security and compliance gaps.

Responsibilities

• Serve as the primary point of contact for our third-party penetration testing vendor(s)
• Coordinate scoping, scheduling, and rules of engagement for pen test engagements
• Review vendor findings and reports; translate technical findings into remediation tickets for IT
• Track remediation timelines and confirm fixes are validated (retesting, evidence of closure)
• Evaluate and, when needed, help select new pen test vendors based on scope, cost, and quality
• Own the day-to-day relationship with our SOC 2 auditor and any compliance automation platform (e.g., Vanta, Drata, Secureframe)
• Collect, organize, and submit evidence requested by the auditor across control owners and departments
• Track audit timelines and deliverables; escalate blockers before they become deadline risks
• Manage responses to auditor follow-up questions and any noted exceptions
• Maintain a continuous, audit-ready evidence trail between audit cycles (not just during the audit window)
• Own the end-to-end response process for inbound client/prospect security questionnaires and due-diligence requests
• Maintain a current library of standard responses, control descriptions, and supporting documentation (e.g., SOC 2 report, pen test summary, policies) to speed up turnaround
• Coordinate with sales, legal, and services as needed to answer non-standard or technical questions accurately
• Track turnaround times and flag recurring gaps that could be solved with better documentation or new controls
• Maintain and periodically review the company's information security policies (access control, data handling, incident response, acceptable use, vendor risk, etc.)
• Ensure policies stay aligned with SOC 2 requirements and evolving business needs
• Track policy acknowledgments and training completion across the company
• Monitor overall security posture — identify gaps between documented policy and actual practice, and drive closure
• Maintain a risk register and support periodic risk assessments

Skills

• 2+ years of experience in a GRC, IT compliance, or security operations role
• Familiarity with SOC 2 (Type I or Type II) and the audit lifecycle
• Experience managing vendors or external service providers
• Strong written communication — you'll be writing policies, auditor responses, and client-facing answers
• Comfortable coordinating across departments (services, IT, sales, legal) to get information and drive action
• Detail-oriented, organized, and able to manage multiple concurrent deadlines (audit cycles, questionnaires, vendor engagements)
• Citizens or Permanent Residents of the USA or Canada. Cannot provide Visa sponsorship
• Virtual, home office in the USA or Canada
• All roles at Cloud for Good include a travel component. Business travel—both domestic and international—may be required based on project and client needs. The amount of travel will vary by role but is generally expected to be up to 30% annually. Travel is considered an essential part of this position and supports effective client engagement, collaboration, and company representation
• Collaboration takes place across Zoom, Office 365, Salesforce, and Slack during standard business hours (9:00 a.m. – 5:00 p.m. in your local time zone)
• As a team member, you may be required to adjust your work hours to align with your key client's time zone to support effective communication, collaboration, and project delivery. Flexibility and coordination with your Project Lead (Services) will help ensure success in this client-facing role
• Experience with compliance automation platforms (Vanta, Drata, Secureframe, Tugboat Logic)
• Familiarity with additional frameworks (ISO 27001, HIPAA, PCI-DSS, GDPR/CCPA)
• Experience responding to enterprise client security questionnaires (e.g., via SIG, CAIQ, or custom formats)
• Relevant certifications: Security+, CISA, CRISC, or similar
• Basic understanding of penetration testing methodology (enough to read and interpret vendor reports, not perform testing)

Benefits

• Virtual, home office in the USA or Canada
• Cloud for Good is a fully remote company.

Company Overview