GRC Associate (Contract)

This is a remote position.
About the Role:
We're looking for a part-time GRC Associate to do the day-to-day work of our governance, risk and compliance program. You'll own the deliverables: audit evidence, security questionnaire responses, the compliance calendar, and vendor reviews. You'll partner closely with our security engineers, Sales and Solutions Engineering. The Head of Security owns program strategy, risk decisions and policy sign-off.
What you'll do
Audit readiness (SOC 2 Type II, PCI DSS)

Run day-to-day work in Drata: map controls, connect integrations, close gaps, and keep evidence collection current

Coordinate the SOC 2 audit cycle: auditor coordination, evidence requests, walkthroughs, and tracking exceptions and remediation

Run the biannual and quarterly PCI reviews and track external scan findings to closure

Prepare recurring SOC 2 evidence, including quarterly access and group reviews, audit-log exports, and incident summaries

Chase owners to close postmortem follow-ups and control gaps across Engineering, Infra/DevOps, IT, HR and People Ops

Customer trust and sales support

Be first responder on security questionnaires, DDQs and customer vendor-risk reviews (about 4–8 a month). These include SIG, CAIQ and custom bank questionnaires, often submitted through customer portals such as LogicGate, Aravo and Coupa.

Keep the security answers current in the answer library that Solutions Engineering maintains. New or changed security claims get Security sign-off before they go out.

Build a reusable screenshot evidence pack for customers that won't accept Trust Center links

Keep our Trust Center current: SOC 2 report, pen test summary, policies and subprocessors

Review customer security requirements in MSAs and DPAs, and keep our customer security requirements tracker up to date

Policies, risk and governance

Run the annual review of our security policy set

Manage the security policy exceptions log

Coordinate the annual risk assessment, keep the risk register current, and prepare the leadership risk review

Coordinate the annual BCP/DR test and write the customer-facing summary

Track the HR-side SOC 2 controls: background checks, security training, onboarding and offboarding

Third-party risk management

Run security assessments of internal-use and non-critical vendors. Support the Head of Security on critical vendor and subprocessor reviews, including annual reviews.

Keep the subprocessor list accurate and drive customer notifications when it changes

Run the intake and review process for new SaaS apps, OAuth apps, AI tools and MCP servers

Partner compliance and program structure

Handle day-to-day compliance work for our data-provider reseller agreements, starting with LexisNexis: customer credentialing, audit readiness and reporting

Build and run a compliance calendar of recurring controls, reviews, audits and renewals, with named owners

Send a monthly GRC status report to the Head of Security

What you'll bring
Must have

2–4 years in GRC, security compliance or IT audit, ideally at a B2B SaaS company selling to regulated customers

Supported at least one SOC 2 Type II audit: evidence collection, control testing and auditor requests

Has answered customer security questionnaires or DDQs

Clear writing: customer-facing answers should need only light review

Organized and persistent; you can track many small asks across teams and follow up without needing escalation

Nice to have

Hands-on experience with a compliance automation platform such as Drata, Vanta, Secureframe or OneTrust

Fintech, BaaS or banking-vendor experience

ISO 27001 experience

AI governance experience (NIST AI RMF, ISO 42001)

PCI DSS exposure; Security+, CISA or ISO 27001 Implementer

Engagement details

Hours:~20 hrs/week, flexible within the week. Volume is bursty around audit and questionnaire cycles.

Location:US Remote. Hours in US Pacific time, or a minimum of 4 hours overlap.

Contract:6-month initial term, renewable, with 30 days' notice to end. Hourly rate.

Onboarding:background check, NDA and security training. Access is through named accounts with least privilege (Drata, Notion, Slack, Google Workspace).

Work Location
This is a remote and hourly position.
Remote work is currently limited to candidates located in the following states:
AZ, CA, CO, GA, ID, IL, KS, MA, MD, NJ, NY, OR, PA, RI, TX, WA.
Compensation
Base:$50-$65/hour
We Offer

Competitive salary and pre-IPO equity

100% company-paid medical, dental, and vision insurance for employees

Unlimited PTO and generous leave programs

401(k)

Learning & development stipend

Home office setup support

A high-ownership, collaborative culture focused on impact, innovation, and growth

Equal Opportunity Employer
Unit21 is an equal opportunity employer. We encourage candidates to apply even if they don't meet every listed requirement. We are committed to building a diverse, inclusive workforce where everyone has the opportunity to thrive.

Originally posted on Himalayas