[All remote jobs](https://jobicy.com/jobs.md)[![Vercel logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/a6aded72-221.png)](https://jobicy.com/company/vercel.md)[Vercel](https://jobicy.com/company/vercel.md) # GRC Analyst Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/vercel.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 134k–202k / yrDepartment[Legal & Compliance](https://jobicy.com/categories/legal.md)EmploymentFull TimeExperienceOpen levelPublished30 Sep 2026Apply before30 Oct 2026Listing views43Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. Vercel is seeking a GRC Analyst to maintain and improve its security, privacy, and compliance program in a cloud-centric environment. The role manages audit readiness, controls, evidence, remediation plans, and compliance frameworks including SOC 2, ISO 27001, HIPAA, and PCI DSS. It also partners with technical and go-to-market stakeholders to integrate controls into the SDLC, respond to security questionnaires, and improve customer-facing compliance documentation. The analyst will help mature GRC operations through process automation, reporting, training, and cross-functional accountability. Candidates need at least three years of relevant audit-lifecycle experience and strong project coordination and communication skills. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a mid-level GRC role requiring practical ownership of multi-framework compliance, audit deliverables, internal controls, and remediation in a fast-growing cloud software company. The work demands sound judgment across technical, regulatory, operational, and customer-facing requirements. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job medianHighly competitive$168,000US market range$120k–$185k0$204k AI insightThe disclosed San Francisco base-pay range is $134,000 to $202,000 USD yearly, with a midpoint of $168,000. This is a competitive range for a GRC Analyst with 3+ years of cloud-compliance and audit-lifecycle experience; the estimated broader US base-salary market range is approximately $120,000 to $185,000 yearly, varying by location, framework expertise, and technical depth. ## Core skills Skills and capabilities most closely associated with this opportunity. [Governance, Risk & Compliance](https://jobicy.com/jobs?search_keywords=Governance%20Risk%20%20Compliance.md)[SOC 2](https://jobicy.com/jobs?search_keywords=SOC%202.md)[ISO 27001](https://jobicy.com/jobs?search_keywords=ISO%2027001.md)[HIPAA](https://jobicy.com/jobs?search_keywords=HIPAA.md)[PCI DSS](https://jobicy.com/jobs?search_keywords=PCI%20DSS.md)[Internal Controls](https://jobicy.com/jobs?search_keywords=Internal%20Controls.md)[Audit Management](https://jobicy.com/jobs?search_keywords=Audit%20Management.md)[Risk Assessment](https://jobicy.com/jobs?search_keywords=Risk%20Assessment.md)[Cloud Security](https://jobicy.com/jobs?search_keywords=Cloud%20Security.md)[Security Questionnaires](https://jobicy.com/jobs?search_keywords=Security%20Questionnaires.md) Sample interview questionsDescribe your approach to preparing for a SOC 2 or ISO 27001 audit.I start by translating the audit scope into a clear control and evidence plan, assigning accountable owners and due dates. I validate evidence quality early, track gaps and remediation in a centralized system, hold regular stakeholder check-ins, and perform a pre-audit review to ensure artifacts demonstrate consistent operation of each control. How would you handle a control deficiency discovered during an audit-readiness review? I would document the deficiency, assess its risk and root cause, and work with the control owner to define a practical remediation plan with milestones. I would track completion, collect validation evidence, communicate status to relevant stakeholders, and identify whether related controls or processes require broader corrective action. How do you partner with engineering teams to embed compliance into the SDLC? I focus on making requirements actionable and proportionate to risk. This includes mapping policies and control objectives to existing engineering workflows, using tooling where possible for evidence collection, agreeing on ownership, and explaining how security practices support reliable delivery and customer trust rather than treating compliance as a separate process. How would you respond to a complex customer security questionnaire under a tight sales deadline? I would first identify reusable, approved answers and supporting materials from the security knowledge base. For new or high-risk questions, I would route targeted requests to the appropriate security, legal, privacy, or engineering owners, maintain clear status updates for the go-to-market team, and ensure all responses accurately reflect the company's implemented controls. What metrics would you use to measure GRC program maturity? I would track metrics such as control operating effectiveness, evidence collection timeliness, audit findings by severity and aging, remediation completion rates, policy-training completion, questionnaire turnaround time, and the proportion of controls with automated evidence. These measures show both compliance health and operational efficiency over time. Opportunity details ## About this role. ### About Vercel: Vercel is the agentic infrastructure company, freeing people and agents to ship what’s next. For more than a decade we’ve helped builders move from idea to production with speed, security, and exceptional developer experience. Now we’re scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. ### About the role: We are looking for a GRC Analyst to join our Governance, Risk & Compliance (GRC) team. You will have the opportunity to manage and maintain ongoing compliance with security and privacy frameworks, policies, procedures, and commercial assessments, including ISO 27001, SOC 2, HIPAA, PCI DSS, and more. Your role will be instrumental in ensuring that our company operates ethically, responsibly, and in accordance with regulatory requirements. You will collaborate with cross-functional teams to promote a culture of accountability and integrity throughout the organization and foster an environment where everyone understands the importance of adhering to established guidelines and ethical practices. You will report to the Head of GRC and will be located ((remote, onsite, hybrid)). Think you may not have all the skills and are hesitant to apply? There is no “perfect” candidate and we encourage you to apply if you think that you can bring value to our team and are passionate and committed to upholding the highest standards of compliance and ethics. If you’re based within a pre-determined commuting distance of one of our offices (SF, NY, London, or Berlin), the role includes in-office anchor days on Monday, Tuesday, and Friday, even if the role is listed as remote. For location-specific details, please connect with our recruiting team. ### What you will do: * Collaborate with internal teams to maintain an effective suite of internal controls and drive remediation efforts to completion with clear documentation of progress. * Build strong working relationships across the business so compliance accountability is shared and stakeholders are informed. * Streamline annual audits by managing audit deliverables, developing treatment plans, and coordinating across teams to document and track completion to ensure audit success. * Monitor and improve controls, processes, and evidence management practices, identify opportunities to automate and streamline GRC operations, and contribute to controls maturity scoring and reporting * Enable go-to-market teams and accelerate deal cycles by supporting security questionnaires, addressing compliance inquiries, and maintaining clear, customer-facing documentation on Vercel’s security and compliance posture. * Design and manage company training and enhance visibility on compliance-specific topics for internal stakeholders to ensure an understanding of compliance, ethics, and regulatory requirements within the organization. ### About you: * At least 3 years of relevant experience in supporting the audit lifecycle in a cloud-centric environment (SOC 2, ISO 27001, PCI, HIPAA, etc.), with strong organizational skills to be flexible and proactive in a high-growth, start-up environment. * Experience collaborating closely with internal partners to seamlessly incorporate policies and technical controls into the SDLC. * Strong project management skills and sense of ownership with the ability to communicate and collaborate effectively, and execute projects across various business units and levels. ### Bonus if you have: * Strong experience with cloud infrastructure (e.g., Azure, AWS) * Familiarity with compliance or software development tools and systems (e.g., Drata, Linear, Datadog, etc.) * Experience with frontend development and open source components * Relevant industry certifications (i.e., CISM, CISSP, CCEP) are a plus, but not required ### Compensation & Benefits: * Competitive compensation package, including equity. * Inclusive Healthcare Package. * Learn and Grow – we provide mentorship and send you to events that help you build your network and skills. * Flexible Time Off. * We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed. The San Francisco, CA base pay range for this role is $134,000-$202,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process. ### Disclosures: * Privacy: Please review our Job Applicant Privacy Policy for more information on how we handle your data. * Equal Opportunity: Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don’t necessarily check every box on the job description. Show more [Apply now >](https://jobicy.com/jobs/154264-grc-analyst-2.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Life360 logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/02/f269bad3-221.jpeg) Life360 Sep 30 New ### [Legal Counsel, IP & Technology](https://jobicy.com/jobs/154257-legal-counsel-ip-technology.md) About Life360 Life360’s mission is to keep people close to the ones they love. Our category-leading mobile app, Tile tracking devices, and Pet GPS tracker empower members to protect the… * ![Alma logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bcae38e1-221.jpeg) Alma Sep 30 New ### [Ascend Resident – In-House Immigration Leader](https://jobicy.com/jobs/152116-ascend-resident-in-house-immigration-leader.md) About the Role The Ascend Residency is a highly competitive paid leadership role within Alma’s peer community for in-house immigration professionals. Each month, one Resident is selected to shape the… * ![NetDocuments logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/d08d5ca3-221.png) NetDocuments Sep 28 New ### [Legal Engineer](https://jobicy.com/jobs/154163-legal-engineer-2.md) NetDocuments is committed to providing an excellent candidate experience and will never ask you to engage in recruitment activity without phone, video, and in person meetings and communications from emails… * ![AlphaSense logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/01960e94-221.jpg) AlphaSense Sep 28 ### [Enterprise Risk Officer, ECRM](https://jobicy.com/jobs/154137-enterprise-risk-officer-ecrm.md) About AlphaSense: The world’s most sophisticated companies rely on AlphaSense to remove uncertainty from decision-making. With market intelligence and search built on proven AI, AlphaSense delivers insights that matter from… * ![Solace logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/4e37a66b-221.png) Solace Sep 28 ### [Product Counsel](https://jobicy.com/jobs/154129-product-counsel.md) About Solace Healthcare in the U.S. is fundamentally broken. The system is so complex that 88% of U.S. adults do not have the health literacy necessary to navigate it without… * ![Brain Co. logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/b2bdd014-221.png) Brain Co. Sep 27 ### [Permitting & Plan Review Expert](https://jobicy.com/jobs/154117-permitting-plan-review-expert.md) Our Mission Rebuild how the world works, to make institutions work better for the people they serve. About Brain Co. Brain Co. builds AI-native operating systems for large, regulated institutions…. * ![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg) Reddit Sep 27 ### [Senior, Business Risk & AI Automation](https://jobicy.com/jobs/151849-senior-business-risk-ai-automation.md) Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit… * ![Binance logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bc822f38-221.jpg) Binance Sep 27 ### [Compliance EDD & High Risk Client Team Lead](https://jobicy.com/jobs/151874-compliance-edd-high-risk-client-team-lead.md) Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. We are trusted by 300+ million people in 100+ countries for… * ![LendingTree logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/03/a087cb002c7df273f6942219c6d4ae5e.jpeg) LendingTree Sep 27 ### [Mortgage Loan Officer (MLO)](https://jobicy.com/jobs/151817-mortgage-loan-officer-mlo.md) PLEASE NOTE: Open to remote candidates; however, occasional travel to Charlotte may be required. The Position As LendingTree’s Utah Lending Manager, you will be an addition to the legal department… * ![LendingTree logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/03/a087cb002c7df273f6942219c6d4ae5e.jpeg) LendingTree Sep 27 ### [Lending Manager (Utah)](https://jobicy.com/jobs/151813-lending-manager-utah.md) PLEASE NOTE: Open to remote candidates; however, occasional travel to Charlotte may be required. The Position As LendingTree’s Utah Lending Manager, you will be an addition to the legal department… [Browse all jobs](https://jobicy.com/jobs.md)