GRC Analyst

Vercel is hiring a Governance, Risk and Compliance (GRC) Analyst to manage compliance programs, audits, and AI and vendor risk assessments. The role also builds AI-powered automations for audit evidence and customer security questionnaires, maintains compliance controls and documentation, and supports customer inquiries and training.

Responsibilities

• Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training
• Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress
• Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores
• Manage annual audit deliverables, write treatment plans, and track completion across teams
• Answer customer compliance inquiries and maintain customer-facing security and compliance documentation

Preferred

• Built an automation or internal tool, with code or AI coding tools, even outside an engineering role
• Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework
• Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification
• Automation Tool Development
• Coding
• AI Coding Tools
• AI Governance Frameworks
• ISO/IEC 42001
• NIST AI Risk Management Framework
• CISM Certification
• CISSP Certification
• CCEP Certification

Benefits

• Equity
• Inclusive Healthcare Package
• Mentorship
• Events that help you build your network and skills
• Flexible Time Off
• We will provide you the gear you need to do your role
• A WFH budget for you to outfit your space as needed
• Eligibility for a company bonus or variable pay program, depending on the role

Company

• Developer platform for building and scaling apps and AI agents
• San Francisco, California, USA
• https://vercel.com/
• Founded in 2015
• 501-1000 employees

Qualifications

• 3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment
• Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review
• Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners
• Led compliance projects across multiple business units and seniority levels
• Built an automation or internal tool, with code or AI coding tools, even outside an engineering role
• Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework
• Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification

Required skills

• AI Security and Privacy Controls, CISM, CISSP, Cloud Compliance, ISO 27001, ISO/IEC 42001, NIST AI Risk Management Framework, PCI DSS, SOC 2, Security Policies and Technical Controls in SDLC, Third-Party Risk Review

Experience

• 3+ years