GRC Analyst

Job title: GRC Analyst

About the Role We are seeking a GRC Analyst to join Vercel's Governance, Risk & Compliance (GRC) team. You will manage and maintain ongoing compliance with security and privacy frameworks (e.g., ISO 27001, SOC 2, HIPAA, PCI DSS), policies, procedures, and commercial assessments, ensuring the company operates ethically and in line with regulatory requirements. You will collaborate with cross-functional teams to promote accountability and integrity, reporting to the Head of GRC. This is a remote-friendly role with potential in-office anchor days for certain locations.

What You'll Do

• Collaborate with internal teams to maintain an effective suite of internal controls and drive remediation with clear documentation of progress.
• Build strong working relationships across the business so compliance accountability is shared and stakeholders are informed.
• Streamline annual audits by managing audit deliverables, developing treatment plans, and coordinating across teams to document and track completion to ensure audit success.
• Monitor and improve controls, processes, and evidence management practices; identify opportunities to automate and streamline GRC operations; contribute to controls maturity scoring and reporting.
• Enable go-to-market teams and accelerate deal cycles by supporting security questionnaires, addressing compliance inquiries, and maintaining clear, customer-facing documentation on Vercel's security and compliance posture.
• Design and manage company training and enhance visibility on compliance-specific topics for internal stakeholders to ensure an understanding of compliance, ethics, and regulatory requirements within the organization.

What We're Looking For

• At least 3 years of relevant experience in supporting the audit lifecycle in a cloud-centric environment (SOC 2, ISO 27001, PCI, HIPAA, etc.), with strong organizational skills to be flexible and proactive in a high-growth, startup environment.
• Experience collaborating closely with internal partners to seamlessly incorporate policies and technical controls into the SDLC.
• Strong project management skills and sense of ownership with the ability to communicate and collaborate effectively, and execute projects across various business units and levels.

Nice to Have

• Strong experience with cloud infrastructure (e.g., Azure, AWS)
• Familiarity with compliance or software development tools and systems (e.g., Drata, Linear, Datadog, etc.)
• Experience with frontend development and open source components
• Relevant industry certifications (i.e., CISM, CISSP, CCEP) is a plus, but not required

Compensation & Benefits

• Base pay range: $134,000-$202,000 (San Francisco, CA). Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location.
• Competitive compensation package, including equity.
• Inclusive Healthcare Package.
• Learn and Grow — mentorship and events to build your network and skills.
• Flexible Time Off.
• We'll provide gear and a WFH budget to outfit your space as needed.