GRC Security Analyst

What You Will Work On

As a GRC Security Analyst, you will ensure Clear Capital adheres to all relevant security standards, regulations, and policies within the mortgage lending and appraisal industry. Your role is critical in maintaining our Governance, Risk, and Compliance (GRC) posture.

Key Responsibilities:

• Monitor and enforce compliance with critical security frameworks such as NIST CSF, NIST RMF, ISO 27001/27002, SOC 2, ISO 42001, and industry-specific regulations like GLBA, CCPA, GDPR.
• Conduct comprehensive risk assessments to identify security vulnerabilities, evaluate existing controls, and resolve issues using judgment and interpretation.
• Develop, maintain, and adapt security policies, procedures, and guidelines aligned with industry best practices, client requirements, and mortgage lending standards.
• Lead preparation and participation in internal and external security audits, resolving audit findings based on limited information and precedent.
• Enhance cross-functional team relationships to implement remediation plans for security gaps and weaknesses.
• Evaluate third-party vendor security postures and ensure compliance with contractual security requirements to protect sensitive financial and property data.
• Maintain accurate records of compliance activities, findings, and remediation efforts, creating reports for management, clients, and regulatory authorities.
• Define qualitative and quantitative metrics to assess the success of the security program and provide regular reports to leadership.
• Stay updated on emerging security threats, technologies, and regulatory changes in the financial and real estate tech space.
• Perform other relevant duties as assigned.

Who We Are Looking For

• A candidate with 5+ years of experience in GRC, security compliance, or risk management, or 3 years with a Master’s degree, or equivalent experience.
• In-depth knowledge of security frameworks (NIST CSF, SOC 2, ISO 27001, ISO 42001) and data privacy regulations (GLBA, GDPR, CCPA).
• Relevant certifications such as CISSP, CISM, CISA, CRISC, or AIGP.
• Sophisticated analytical and problem-solving skills to address complex security issues independently.
• Strong communication and interpersonal skills to advise senior stakeholders on compliance matters.
• Familiarity with GRC technologies (e.g., Vanta, Drata, OneTrust) and risk assessment tools.
• Detail-oriented focus on accuracy in documentation, reporting, and policy formulation.
• Commitment to maintaining confidentiality, integrity, and professionalism.
• Understanding of legacy and progressive technologies, including cloud computing, DevOps, and application security.
• Advanced proficiency in spreadsheets for data analysis, audit metric tracking, and compliance reporting.