Senior GRC Analyst

About the Role

Nametag is seeking an experienced Senior GRC Analyst to own and evolve our security and compliance program. This role is ideal for someone who thrives in a fast-paced startup environment, has deep experience with SOC 2 and other compliance frameworks, and is comfortable building and running programs with limited resources. You will report directly to the Head of Engineering and partner closely with the engineering team to ensure security is built into everything we do.

As a Senior GRC Analyst, you will own the entire security and compliance function as an individual contributor, maintaining our existing certifications, driving new compliance initiatives, coordinating penetration tests, and building trust with customers and prospects. You will work closely with engineering, product, sales, and customer success to ensure security enables the business rather than blocking it.

What You'll Do

Compliance Program Management

• Own and maintain SOC 2 Type II certification, including evidence collection, control monitoring, and audit coordination
• Drive IAL3 compliance readiness and implementation
• Manage accessibility compliance (WCAG) requirements
• Identify and pursue additional certifications as needed based on customer and market requirements

Security Operations

• Coordinate penetration testing cycles and drive remediation with engineering
• Maintain a living view of organizational risk and surface it to leadership
• Develop and maintain security policies, procedures, and controls
• Respond to security incidents with speed and clarity

Customer Trust

• Respond to customer security questionnaires promptly and accurately
• Support sales in security-sensitive enterprise deals
• Maintain public-facing trust documentation
• Participate in customer security calls and reviews as needed

Cross-Functional Partnership

• Partner with engineering to build security into the development process
• Provide clear security guidance and timely reviews so teams can ship with confidence
• Collaborate with product on security and accessibility features
• Work with customer success to address customer security concerns

Ideal Qualifications

We know that no candidate will perfectly match every requirement, and that's okay. If you're passionate about what we're building and have most of the skills below, we'd love to hear from you.

• 5+ years of experience in security, compliance, or GRC, with demonstrated hands-on ownership of SOC 2 Type II programs
• Experience building or running compliance programs in startup or resource-constrained environments
• Strong understanding of how auditors think, ideally from auditor-side experience or running multiple audit cycles
• Technical fluency to read pen test reports, understand cloud architecture, and have informed conversations with engineers
• Knowledge of GRC tooling and vendors, with opinions on what's worth investing in at different company stages
• Excellent communication skills, able to translate security topics for executives, salespeople, and customers
• Experience with identity verification, authentication, or security-focused products is a strong plus
• Familiarity with IAL2/IAL3 or NIST 800-63 identity proofing standards is a strong plus
• CISSP, ISO 27001 Lead Auditor, or similar certifications are a plus but not required