GRC Analyst

Security & IT London, New York City, San Francisco Full Time GRC Analyst Careers /Security & IT Security & IT London, New York City, San Francisco Full Time About Vercel Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience. Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. About The Role We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London with three days a week in the office. What You’ll Do Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics trainingMaintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progressUse AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scoresManage annual audit deliverables, write treatment plans, and track completion across teamsAnswer customer compliance inquiries and maintain customer-facing security and compliance documentation What You Need 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environmentApplied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk reviewBuilt security policies and technical controls into the software development lifecycle (SDLC) with engineering partnersLed compliance projects across multiple business units and seniority levels Bonus If You Built an automation or internal tool, with code or AI coding tools, even outside an engineering roleWorked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management FrameworkHold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification Compensation & Benefits Competitive compensation package, including equity.Inclusive Healthcare Package.Learn and Grow - we provide mentorship and send you to events that help you build your network and skills.Flexible Time Off.We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed. The San Francisco, CA base pay range for this role is $134,000-$202,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process. Disclosures Privacy: Please review our Job Applicant Privacy Policy for more information on how we handle your data.Equal Opportunity: Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description. Apply Now. Tell us why you’d be a good fit for the GRC Analyst role. First Name input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)]" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> Last Name input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)]" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> Email Address input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)]" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> Phone Number InternationalAfghanistanÅland IslandsAlbaniaAlgeriaAmerican SamoaAndorraAngolaAnguillaAntigua and BarbudaArgentinaArmeniaArubaAscension IslandAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBoliviaBonaire, Sint Eustatius and SabaBosnia and HerzegovinaBotswanaBrazilBritish Indian Ocean TerritoryBrunei DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCanadaCape VerdeCayman IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling) IslandsColombiaComorosCongoCongo, Democratic Republic of theCook IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland IslandsFaroe IslandsFederated States of MicronesiaFijiFinlandFranceFrench GuianaFrench PolynesiaGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuamGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHoly See (Vatican City State)HondurasHong KongHungaryIcelandIndiaIndonesiaIranIraqIrelandIsle of ManIsraelItalyJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKosovoKuwaitKyrgyzstanLaosLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacaoMadagascarMalawiMalaysiaMaldivesMaliMaltaMarshall IslandsMartiniqueMauritaniaMauritiusMayotteMexicoMoldovaMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk IslandNorth KoreaNorth MacedoniaNorthern Mariana IslandsNorwayOmanPakistanPalauPalestinePanamaPapua New GuineaParaguayPeruPhilippinesPolandPortugalPuerto RicoQatarReunionRomaniaRussiaRwandaSaint BarthélemySaint HelenaSaint Kitts and NevisSaint LuciaSaint Martin (French Part)Saint Pierre and MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint MaartenSlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth KoreaSouth SudanSpainSri LankaSudanSurinameSvalbard and Jan MayenSwazilandSwedenSwitzerlandSyriaTaiwanTajikistanTanzaniaThailandTimor-LesteTogoTokelauTongaTrinidad and TobagoTristan da CunhaTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited Arab EmiratesUnited KingdomUnited StatesUruguayUzbekistanVanuatuVenezuelaVietnamVirgin Islands, BritishVirgin Islands, U.S.Wallis and FutunaWestern SaharaYemenZambiaZimbabwe Resume Resume should be a PDF under 3.5MB. Are you currently based in any of these countries? Please note these are the only countries where we are accepting applications United States Germany United Kingdom Argentina Australia Canada India Japan Other Which office are you willing to work from Monday, Tuesday, and Friday? San Francisco (open to relocation)New York City (open to relocation)London (open to relocation) Do you live in one of the following states? Alabama, Alaska, Delaware, Kansas, Maine, Mississippi, Montana, Nebraska, New Mexico, North Dakota, South Dakota, West Virginia, or Wyoming. Yes No Will you require Visa Sponsorship now, or in the future? Yes No Are you authorized to work in the country you live in? Please choose the option that describes your work authorization. I am authorized to work in the country due to my nationality I am authorized to work in the country based on a valid work permit and do not need a company to sponsor my visa I am authorized to work in the country based on a valid work permit which needs to be sponsored by the company I work for I am not authorized to work in the country and need visa support Other By submitting my application, I acknowledge that I have read and understand Vercel’s Job Applicant Privacy Notice ↗ Acknowledge/Confirm Please double-check all the information provided above. Ensuring accuracy is crucial, as any errors or omissions may impact the review of your application. I have reviewed and confirmed that all the information provided is accurate and complete. Where did you first hear about this role? Events Built In LinkedIn Google Search Advertisements Other job boards LLMs (ChatGPT, etc.) I'm a Vercel customer Referral from a Vercel customer Referral from a Vercel team member Social media (X, Instagram, YouTube, etc.) Other Content (news articles, podcasts, blogs) Developer communities (GitHub, Hacker News, Reddit, etc.) Other U.S. Standard Demographic Questions. At Vercel, we value belonging and believe in fostering an environment where a diversity of perspectives can thrive. As part of this commitment, we invite you to voluntarily provide demographic information. Your responses will be used (in aggregate only) to help us better understand the diversity of our applicants and identify areas of improvement in our recruitment and hiring process. Your responses, or decision not to respond, will be kept confidential and will only be used in aggregate form for diversity and inclusion efforts. This information will not be associated with your specific application and will not be disclosed to the hiring team or used in the hiring decision in any way. Individuals seeking employment are considered without regard to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, or sexual orientation. Asking the below questions help us comply with federal and state Equal Employment Opportunity/Affirmative Action record keeping, reporting, and other legal requirements. How would you describe your gender identity? (mark all that apply) Man Non-binary Woman I prefer to self-describe I don't wish to answer How would you describe your racial/ethnic background? (mark all that apply) Black or of African descent East Asian Hispanic, Latinx or of Spanish Origin Indigenous, American Indian or Alaska Native Middle Eastern or North African Native Hawaiian or Pacific Islander South Asian Southeast Asian White or European I prefer to self-describe I don't wish to answer How would you describe your sexual orientation? (mark all that apply) Asexual Bisexual and/or pansexual Gay Heterosexual Lesbian Queer I prefer to self-describe I don't wish to answer Do you identify as transgender? Yes No I prefer to self-describe I don't wish to answer Do you have a disability or chronic condition (physical, visual, auditory, cognitive, mental, emotional, or other) that substantially limits one or more of your major life activities, including mobility, communication (seeing, hearing, speaking), and learning? Yes No I prefer to self-describe I don't wish to answer Are you a veteran or active member of the United States Armed Forces? Yes, I am a veteran or active member No, I am not a veteran or active member I prefer to self-describe I don't wish to answer Optionally, include links to your social media profiles. LinkedIn input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] [&>:nth-child(2)]:border-r [&>:nth-child(2)]:border-[var(--ds-gray-alpha-400)] [&>:nth-child(2)]:shrink-0 [&>:nth-child(2)]:relative [&>:nth-child(2)]:text-[var(--ds-gray-700)] [&>:nth-child(2)]:px-3 [&>:nth-child(2)]:py-0 [&>:nth-child(2)]:flex [&>:nth-child(2)]:items-center [&>:nth-child(2)]:order-0 [&>:nth-child(2)]:bg-[var(--ds-background-200)] [&>:first-child:not([disabled])]:text-[var(--themed-fg)] [&>input]:rounded-tl-none [&>input]:rounded-bl-none" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> svg]:size-(--ds-control-decoration-size)">linkedin.com/in/ X (Twitter) input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] [&>:nth-child(2)]:border-r [&>:nth-child(2)]:border-[var(--ds-gray-alpha-400)] [&>:nth-child(2)]:shrink-0 [&>:nth-child(2)]:relative [&>:nth-child(2)]:text-[var(--ds-gray-700)] [&>:nth-child(2)]:px-3 [&>:nth-child(2)]:py-0 [&>:nth-child(2)]:flex [&>:nth-child(2)]:items-center [&>:nth-child(2)]:order-0 [&>:nth-child(2)]:bg-[var(--ds-background-200)] [&>:first-child:not([disabled])]:text-[var(--themed-fg)] [&>input]:rounded-tl-none [&>input]:rounded-bl-none" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> svg]:size-(--ds-control-decoration-size)">x.com/ GitHub input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] [&>:nth-child(2)]:border-r [&>:nth-child(2)]:border-[var(--ds-gray-alpha-400)] [&>:nth-child(2)]:shrink-0 [&>:nth-child(2)]:relative [&>:nth-child(2)]:text-[var(--ds-gray-700)] [&>:nth-child(2)]:px-3 [&>:nth-child(2)]:py-0 [&>:nth-child(2)]:flex [&>:nth-child(2)]:items-center [&>:nth-child(2)]:order-0 [&>:nth-child(2)]:bg-[var(--ds-background-200)] [&>:first-child:not([disabled])]:text-[var(--themed-fg)] [&>input]:rounded-tl-none [&>input]:rounded-bl-none" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> svg]:size-(--ds-control-decoration-size)">github.com/ Portfolio input]:h-(--ds-size-medium) text-sm [&>input]:px-3 has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(0,0,0,0.16)] dark-theme:has-[:focus]:!shadow-[0_0_0_1px_var(--ds-gray-alpha-600),0px_0px_0px_4px_rgba(255,255,255,0.24)] hover:shadow-[0_0_0_1px_var(--ds-gray-alpha-500)] hover:[&:has(input:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] hover:[&:has(textarea:disabled)]:shadow-[0_0_0_1px_var(--ds-gray-alpha-400)] [&>:nth-child(2)]:border-r [&>:nth-child(2)]:border-[var(--ds-gray-alpha-400)] [&>:nth-child(2)]:shrink-0 [&>:nth-child(2)]:relative [&>:nth-child(2)]:text-[var(--ds-gray-700)] [&>:nth-child(2)]:px-3 [&>:nth-child(2)]:py-0 [&>:nth-child(2)]:flex [&>:nth-child(2)]:items-center [&>:nth-child(2)]:order-0 [&>:nth-child(2)]:bg-[var(--ds-background-200)] [&>:first-child:not([disabled])]:text-[var(--themed-fg)] [&>input]:rounded-tl-none [&>input]:rounded-bl-none" data-geist-input-wrapper="" data-version="v1" style="width:100%;--geist-icon-size:16px"> svg]:size-(--ds-control-decoration-size)">https://