Senior Information Security GRC Analyst

About the role

We are on a mission to protect the financial futures of millions of customers by building robust compliance programs. As an innovative consumer financial services company dedicated to improving financial mobility, we seek an Information Security GRC Analyst III who brings technical depth and a human‑centered mindset to safeguard what matters most. In this role you will serve as the operational backbone of our compliance posture, owning end‑to‑end audit readiness, driving certifications, managing risk, and partnering across the organization to ensure customer data is protected with the same care we bring to every decision.

Responsibilities

• Design, implement, audit, and maintain GRC controls across our information security program
• Own SOC 2 Type II readiness and certification from end to end — evidence collection, control testing, gap remediation, and auditor liaison
• Drive ISO 27001 certification and ongoing ISMS maintenance, including SoA reviews and management reviews
• Maintain risk registers, conduct risk assessments, and escalate material risks with actionable mitigation plans
• Partner with IT, SecOps, Legal, and Internal Audit to operationalize controls across access management, encryption, logging, and vulnerability management
• Leverage GRC platform automation for real‑time control health visibility and continuous monitoring
• Manage our Third‑Party Risk Management (TPRM) program, including vendor assessments and security questionnaires
• Deliver executive‑ and Board‑level dashboards that tell the story of our risk posture with clarity and confidence
• Develop training and compliance guidance that empowers every business unit to own their part of our security culture

Requirements

• 3–5+ years of experience in information security GRC, compliance, or audit roles
• Hands‑on experience with SOC 2 Type II audits as an auditee, control owner, or auditor
• Working knowledge of SOC 2, ISO 27001, NIST CSF, NIST SP 800‑53, and CIS Controls
• Demonstrated ability to manage risk registers, assessments, and remediation tracking
• Strong written and verbal communication skills — you write policies as clearly as you write executive briefings
• A project‑managed mindset that keeps multiple workstreams moving forward simultaneously
• Experience working within a GRC platform

Skills

• Background in financial services, fintech, or consumer lending
• Familiarity with PCI DSS, GLBA, CCPA, or state‑level financial privacy regulations
• Certifications such as CISA, CRISC, CISSP, or ISO 27001 Lead Auditor/Implementer

Benefits

• Proudly certified as a Great Place to Work
• Committed to building a dynamic, diverse workplace where every employee can reach their full potential
• Meaningful work
• Collaborative culture
• Opportunity to grow