About the Role We are looking for an experienced GRC Analyst to join a growing cybersecurity and compliance team supporting U.S.-based startups and technology companies.

In this hands-on role, you will manage day-to-day compliance operations across multiple client accounts, ensuring security controls are properly implemented, evidence is audit-ready, and compliance requirements are met.

You will work with different regulatory and security frameworks, GRC platforms, and client environments, collaborating with U.S.-based security and compliance professionals.

This opportunity is adecuado for someone with strong GRC knowledge, excellent attention to detail, and experience managing multiple clients or compliance engagements simultaneously.

Key Responsibilities

- Manage daily compliance operations across multiple client accounts.
- Monitor GRC platforms, including control status, evidence freshness, failing tests, and integrations.
- Identify and remediate failing controls, ensuring issues are tracked through resolution.
- Collect, organize, and maintain audit-ready evidence for SOC 2, ISO 27001, and other compliance frameworks.
- Support SOC 2 Type I and Type II audits, ISO 27001 assessments, and related compliance activities.
- Conduct user access reviews, vendor risk assessments, and third-party security evaluations.
- Perform initial gap assessments and develop prioritized remediation plans for new clients.
- Configure GRC platforms and support the implementation of security controls.
- Respond to client compliance questions through Slack, providing clear and accurate guidance.
- Complete security questionnaires, due diligence questionnaires (DDQs), and vendor assessments.




- Support user provisioning and deprovisioning processes across platforms such as Okta, Google Workspace, Slack, and Jamf.
- Track tasks, remediation activities, and client requests using Linear or similar project management tools.
- Provide regular progress updates to engagement leads and escalate critical issues when necessary.

Requirements

- 2-4 years of hands-on experience in GRC, IT audit, cybersecurity compliance, or security operations.
- Proven experience managing multiple clients or compliance engagements simultaneously. This is a mandatory requirement.
- Working knowledge of at least two of the following frameworks:
- SOC 2
- ISO 27001
- HIPAA
- NIST 800-53
- CMMC
- PCI DSS
- GDPR

- Hands-on experience with at least one GRC platform, such as Drata, Vanta, Secureframe, Thoropass, or Sprinto.
- Strong written English communication skills, with the ability to communicate professionally with U.S.-based clients.
- Ability to work with substantial overlap with U.S. business hours, primarily Eastern Time.
- Strong organizational skills and attention to detail.
- Ability to work independently, manage competing priorities, and meet deadlines.

Nice to Have

- Experience working at an audit firm performing SOC 2 or ISO 27001 readiness assessments or control testing.




- Experience with GRC platform implementation or professional services.
- Background working at an MSP, MSSP, or consulting firm supporting multiple clients.
- Familiarity with cloud environments such as AWS, GCP, or Azure.
- Experience with identity management platforms such as Okta, Google Workspace, or Microsoft Entra ID.
- Familiarity with MDM solutions such as Jamf or Intune.
- Experience using Linear, Jira, or similar project management tools.
- Relevant certifications such as CISA, Security+, CRISC, or ISO 27001 Lead Implementer.

Working Conditions

- Location: Fully Remote.
- Employment Type: Full-Time, Dedicated.
- Schedule: U.S. business hours, primarily Eastern Time.
- Team: Work directly with U.S.-based cybersecurity and compliance professionals.
- Engagement: Dedicated position supporting a portfolio of client accounts.

What We Offer

- Full-time employment with benefits and paid time off under applicable local labor regulations.
- Fully remote work environment.
- Direct exposure to major cybersecurity and compliance frameworks.
- Opportunities to work with leading GRC platforms and security technologies.
- Access to AI-powered tools and workflows.
- Mentorship and professional development opportunities.
- The opportunity to grow alongside an expanding cybersecurity and compliance team.

Important Information

- This is a full-time position and must be your primary professional commitment.
- Candidates must be comfortable working with sensitive client information and completing identity, background, and reference checks.
- A practical assessment will be part of the selection process.

📌 GRC Analyst (Compliance Operations) (Colombia)
🏢 Outsourced
📍 Colombia