Senior Security GRC Analyst

Monarch is seeking a Senior Security GRC Analyst to join our Security team. Reporting to the Manager of Corporate and Infrastructure Security, you'll own the day-to-day of our compliance program and customer security assurance function while maturing our overall GRC program. This is a builder-operator role that runs on cross-coordination and precision: you'll work daily with People, Legal, IT, Operations, Engineering, and leadership, automating the repetitive work so the program scales as we grow.

What You'll Do:

• Own and mature our compliance framework: continuous controls monitoring, develop security awareness training, evidence currency, audit coordination — collecting and presenting evidence, pulling the right people into auditor calls, and managing findings to closure.
• Automate GRC — evidence collection, questionnaire responses, risk management workflows, and enforcing compliance — using compliance platforms and AI tooling.
• Own the third-party risk management (TPRM) program: vendor security assessments, risk tiering, approval workflows, and continuous monitoring.
• Develop, maintain, and mature our risk management program — risk register, risk assessments, treatment tracking, and reporting to leadership.
• Write, maintain, and update security policies and procedures, keeping documentation current as our control environment evolves.
• Own and scale customer assurance end to end — security questionnaires, evidence requests, trust center content, and knowledge base.

What You'll Bring:

• 3-5 years operating and scaling security GRC, compliance, or customer assurance programs in high-growth environments — security GRC specifically.
• Hands on security knowledge — you have worked on designing and developing the technical controls behind the frameworks (IAM, endpoint, cloud infrastructure) well enough to speak credibly with both auditors and engineers.
• Meticulous attention to detail — you can sit down and work a sensitive or content heavy document line by line quickly, you deeply care about the nuances.
• Strong cross-functional coordination — this role lives across People, Legal, IT, Operations, Engineering, and leadership. This will frequently require gathering of people and pushing the needle forward.
• Hands-on experience writing, maintaining, and updating security policies, standards, and procedures.
• Hands-on experience with SOC 2 or equivalent and customer assurance (security questionnaires, evidence requests, RFPs).
• Experience with compliance platforms and continuous controls monitoring (Vanta, Drata, Oneleet, SafeBase, or similar).
• Experience leveraging AI tools (Claude, ChatGPT) for GRC workflows.
• Strong written communication for customer-facing security responses and audit documentation.

Nice to Haves:

• Incident response or SOC/security operations background.
• Auditor background — time on the audit side (e.g., Big 4 or security audit firms) or serving as an internal audit lead.
• Developed agents and/or tools to assist with GRC related workflows.
• Experience supporting contract reviews from the security side (e.g., assessing customer redlines against our security posture, legal contracts).
• Fintech or financial services background.
• Relevant certifications (CISSP, CISA, CRISC, or equivalent).