[All remote jobs](https://jobicy.com/jobs.md)[![YipitData logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e1bee9df-221.jpg)](https://jobicy.com/company/yipitdata.md)[YipitData](https://jobicy.com/company/yipitdata.md) # GRC (Governance, Risk, and Compliance) Analyst Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/yipitdata.md)ShareRemote from[USA](https://jobicy.com/job-region/usa.md)SalaryUSD 102,500–102,500 / yrDepartment[Legal & Compliance](https://jobicy.com/categories/legal.md)EmploymentFull TimeExperienceSeniorPublished20 Oct 2026Apply before19 Nov 2026Listing views45Application actions3Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. YipitData seeks a GRC Analyst to own governance, risk, and compliance workstreams across audits, control testing, risk assessments, vendor reviews, policies, and customer security questionnaires. The role requires hands-on SOC 2 experience, evidence validation, remediation tracking, and the ability to map controls across security frameworks such as SOC 2 and NIST CSF. The analyst will partner with Security, IT, Engineering, Legal, Finance, and People teams to translate requirements into actionable work. This is a fully remote US role with flexible hours, although most team members work East Coast hours. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThe position demands practical judgment in determining whether evidence genuinely proves controls, identifying meaningful risk gaps, and driving remediation across multiple stakeholders. Its broad scope, audit readiness expectations, and emerging AI governance work make it more complex than documentation-focused compliance roles. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$102,500US market range (per year)$90k–$125k0$137.50k AI insightThe employer explicitly states an annual base salary of $102,500 USD per year. Estimated US market compensation for a GRC Analyst with hands-on SOC 2, audit, risk, and vendor-assessment responsibilities is approximately $90,000–$125,000 USD annually; this is an AI estimate, not verified salary research. ## Core skills Skills and capabilities most closely associated with this opportunity. [Governance, Risk and Compliance](https://jobicy.com/jobs?search_keywords=Governance%20Risk%20and%20Compliance.md)[SOC 2](https://jobicy.com/jobs?search_keywords=SOC%202.md)[NIST Cybersecurity Framework](https://jobicy.com/jobs?search_keywords=NIST%20Cybersecurity%20Framework.md)[Security Control Testing](https://jobicy.com/jobs?search_keywords=Security%20Control%20Testing.md)[Risk Assessment](https://jobicy.com/jobs?search_keywords=Risk%20Assessment.md)[Audit Coordination](https://jobicy.com/jobs?search_keywords=Audit%20Coordination.md)[Vendor Risk Management](https://jobicy.com/jobs?search_keywords=Vendor%20Risk%20Management.md)[Compliance Documentation](https://jobicy.com/jobs?search_keywords=Compliance%20Documentation.md)[Policy Development](https://jobicy.com/jobs?search_keywords=Policy%20Development.md)[Remediation Tracking](https://jobicy.com/jobs?search_keywords=Remediation%20Tracking.md)[Security Questionnaires](https://jobicy.com/jobs?search_keywords=Security%20Questionnaires.md)[Evidence Validation](https://jobicy.com/jobs?search_keywords=Evidence%20Validation.md)[AI Governance](https://jobicy.com/jobs?search_keywords=AI%20Governance.md)[Cross-functional Communication](https://jobicy.com/jobs?search_keywords=Cross-functional%20Communication.md) Sample interview questionsHow do you determine whether audit evidence genuinely proves that a security control is operating effectively?I start with the control objective and identify the expected population, frequency, owner, and approval or review criteria. I then verify that the evidence is complete, timely, attributable to the right system or person, and demonstrates actual performance rather than merely the existence of a policy or template. Describe how you would manage a SOC 2 control deficiency from discovery through closure. I would document the deficiency, assess its scope and risk, and meet with the control owner to understand root cause. I would agree on a realistic remediation plan with milestones, track progress and evidence of implementation, validate that the fix operates effectively, and retain a clear audit trail of the closure decision. How would you map a control across SOC 2 and NIST CSF requirements? I would compare the intent and criteria of each framework requirement, then identify whether one control activity satisfies multiple objectives. I would document the mapping, control owner, evidence source, testing approach, and any gaps so the organization can reduce duplicate work while preserving framework-specific coverage. How do you handle a stakeholder who provides incomplete or inconsistent evidence? I would explain the requirement and the specific issue in practical terms, ask focused follow-up questions, and offer examples of acceptable evidence. If uncertainty remains, I would document the risk, escalate appropriately, and work with the stakeholder on a proportionate remediation path rather than accepting unsupported assertions. What GRC considerations would you prioritize for new AI products or agents? I would assess data classification and use, access controls, third-party and model-provider risk, logging, monitoring, human oversight, change management, and incident response. I would also establish clear ownership, document risk decisions, and ensure controls remain aligned with applicable privacy, security, and customer commitments. Opportunity details ## About this role. About Us: YipitData is the leading market research and analytics firm for the disruptive economy and most recently raised $475M from The Carlyle Group at a valuation of over $1B. Every day, our proprietary technology analyzes billions of alternative data points to uncover actionable insights across sectors like software, AI, cloud, e-commerce, ridesharing, and payments. Our data and research teams transform raw data into strategic intelligence, delivering accurate, timely, and deeply contextualized analysis that our customers—ranging from the world’s top investment funds to Fortune 500 companies—depend on to drive high-stakes decisions. From sourcing and licensing novel datasets to rigorous analysis and expert narrative framing, our teams ensure clients get not just data, but clarity and confidence. We operate globally with offices in the US, APAC, and India. Our award-winning, people-centric culture—recognized by Inc. as a [Best Workplace](https://www.inc.com/profile/yipitdata) for three consecutive years—emphasizes transparency, ownership, and continuous mastery. What It’s Like to Work at YipitData: YipitData isn’t a place for coasting—it’s a launchpad for ambitious, impact-driven professionals. From day one, you’ll take the lead on meaningful work, accelerate your growth, and gain exposure that shapes careers. Why Top Talent Chooses YipitData: * Ownership That Matters: You’ll lead high-impact projects with real business outcomes * Rapid Growth: We compress years of learning into months * Merit Over Titles: Trust and responsibility are earned through execution, not tenure * Velocity with Purpose: We move fast, support each other, and aim high—always with purpose and intention If your ambition is matched by your work ethic—and you’re hungry for a place where growth, impact, and ownership are the norm—YipitData might be the opportunity you’ve been waiting for. About The Role: YipitData is looking for a GRC Analyst who likes asking good questions, finding the gaps others miss, and turning complicated requirements into work people can actually complete. You will help us answer some important questions: Are our security controls working the way we say they are? Can we prove it? Where are we taking on risk? What needs to change as our products, technology, and use of AI continue to grow? Your work will span audits, risk assessments, control testing, vendor reviews, customer questionnaires, policies, and compliance programs. You will partner with teams across Security, IT, Engineering, Legal, Finance, and People to understand how the business operates, identify where improvements are needed, and keep the work moving through completion. This is not a role where success means uploading documents to an audit platform. We want someone who is curious enough to understand the evidence, thoughtful enough to challenge it when it does not make sense, and organized enough to make sure nothing important gets lost in the follow-up. This is a remote-friendly opportunity that can sit in NYC (where our headquarters is located), one of our office hubs, or anywhere else in the US. However, depending upon where the remote work is performed, income could be subject to New York State tax withholding. The work hours are flexible on this team, but most employees work East Coast hours. As a GRC Analyst You Will: * Take ownership of GRC workstreams and drive them from the initial request through evidence collection, testing, remediation, and completion * Help keep YipitData audit-ready throughout the year * Test security controls and determine whether they are actually working, rather than simply confirming that a document exists * Conduct risk assessments, identify meaningful gaps, and help teams develop remediation plans that are realistic and effective * Map controls across SOC 2 and other frameworks so one strong control can satisfy multiple requirements * Coordinate recurring work such as access reviews, control testing, policy reviews, risk updates, and audit evidence requests * Review vendors and help determine whether their security practices meet YipitData’s expectations * Support customer security questionnaires by finding the right information, validating it, and making sure our answers are accurate and consistent * Translate compliance requirements into clear actions for teams that do not live and breathe GRC * Draft and maintain policies, standards, control narratives, risk records, metrics, and other program documentation * Track findings and remediation commitments, follow up with owners, and keep issues from quietly sitting open forever * Look for ways to simplify and automate repetitive GRC work so the program can scale with the business * Help us think through governance for emerging technologies, including AI products, agents, and new ways of handling data You Are Likely To Succeed If: * You can operate in an environment that is constantly changing: where not every process is perfect or every answer is immediately available * You have experience in security, compliance, risk, audit, privacy, vendor risk, or another field that taught you how to evaluate whether expectations are being met * You have hands-on SOC 2 experience, including supporting Type I or Type II audits, testing controls, validating evidence, coordinating with auditors, and tracking remediation through completion. * You understand that evidence is only useful if it actually proves the control * You can connect a policy or framework requirement to what people and systems are doing in the real world * You are familiar with SOC 2, NIST CSF, or similar security and compliance frameworks * You are a strong writer who can make complicated requirements clear for those not familiar with security frameworks * You notice inconsistencies, missing information, and answers that do not quite add up * You are comfortable asking follow-up questions and respectfully pushing back when something needs a closer look * You can keep multiple workstreams organized, meet deadlines, and follow through * You communicate well with both technical and non-technical teams and can explain why a requirement matters * You take ownership, use good judgment, and know when to work independently versus when to escalate * You are interested in figuring out how traditional governance needs to evolve for AI and other emerging technologies What We Offer: Our compensation package includes comprehensive benefits, perks, and a competitive salary: * We care about your personal life, and we mean it. We offer flexible work hours, flexible vacation, a generous 401K match, parental leave, team events, wellness budget, learning reimbursement, and more! * Your growth at YipitData is determined by the impact that you are making, not by tenure, unnecessary facetime, or office politics. Everyone at YipitData is empowered to learn, self-improve, and master their skills in an environment focused on ownership, respect, and trust. See more on our high-impact, high-opportunity work environment above. * The annual base salary range for this position is anticipated to be $102,500 / year. Final compensation may be determined by a number of factors, including, but not limited to, the applicant’s experience, knowledge, skills, abilities, and internal team benchmarks. * The compensation package also includes equity. This role may be performed fully remotely within the United States. Please note that our US headquarters are located in NYC. If the remote work is performed outside of these offices, income may be subject to New York State tax withholding. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, marital status, disability, gender, gender identity or expression, or veteran status. We are proud to be an equal opportunity employer. [Job Applicant Privacy Notice](https://www.yipitdata.com/careers/job-applicant-privacy-notice) Show more [Apply now >](https://jobicy.com/jobs/155975-grc-governance-risk-and-compliance-analyst.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Reddit logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/Reddit.jpg) Reddit Oct 20 New ### [Director, Intellectual Property](https://jobicy.com/jobs/156015-director-intellectual-property.md) Reddit is a community of communities. It’s built on shared interests, passion, and trust, and is home to the most open and authentic conversations on the internet. Every day, Reddit… * ![Upstart logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bc2cfa2b-221-1.jpeg) Upstart Oct 20 New ### [Compliance Manager, BSA/AML Program](https://jobicy.com/jobs/155981-compliance-manager-bsa-aml-program.md) About Upstart At Upstart, we’re united by a mission that matters: to radically reduce the cost and complexity of borrowing for all Americans. Every day, we bring creativity, experimentation, and… * ![Binance logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/bc822f38-221.jpg) Binance Oct 20 New ### [Global Financial Crime/Sanctions Legal Counsel](https://jobicy.com/jobs/153656-global-financial-crime-sanctions-legal-counsel.md) Binance is a leading global blockchain ecosystem behind the world’s largest cryptocurrency exchange by trading volume and registered users. We are trusted by 300+ million people in 100+ countries for… * ![Chainguard logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e4b6aacf-221.jpeg) Chainguard Oct 20 New ### [Director, EMEA Government Affairs & Public Policy](https://jobicy.com/jobs/153640-director-emea-government-affairs-public-policy.md) Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations… * ![Affirm logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/fac7714c-221-1.jpg) Affirm Oct 20 New ### [Compliance Manager (Australia)](https://jobicy.com/jobs/151079-compliance-manager-australia.md) Affirm is reinventing credit to make it more honest and friendly, giving consumers the flexibility to buy now and pay later without any hidden fees or compounding interest. Affirm’s International… * ![First Advantage logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/85859bb1-221.png) First Advantage Oct 20 New ### [Part Time Court Researcher – Hardin County, KY](https://jobicy.com/jobs/150389-part-time-court-researcher-hardin-county-ky.md) We are seeking a Part-Time Criminal Court Researcher in Kentucky (Hardin Coutny). Individual must be authorized to work in the US and live within 30 minutes of court house in Kentuck (Hardin County) with a valid… * ![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg) GitLab Oct 19 New ### [Director, Legal – Employment](https://jobicy.com/jobs/155896-director-legal-employment.md) GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50… * ![Submittable logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2022/01/fb2fe80b022541b590972867c58ae74b.jpeg) Submittable Oct 18 ### [Director, Legal](https://jobicy.com/jobs/155765-director-legal.md) At Submittable, we are transforming how organizations create social impact. Our platform empowers thousands of mission-driven organizations, from nonprofits to government entities, to make a difference in their communities and… * ![Goodleap logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/482c4fb7-221.png) Goodleap Oct 18 ### [Assistant General Counsel, Servicing](https://jobicy.com/jobs/155716-assistant-general-counsel-servicing.md) About GoodLeap: GoodLeap is a technology company delivering best-in-class financing and software products for sustainable solutions, from solar panels and batteries to energy-efficient HVAC, heat pumps, roofing, windows, and more…. * ![Teramind logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/5f73db18-221.png) Teramind Oct 18 ### [Law Clerk/Counsel](https://jobicy.com/jobs/155687-law-clerk-counsel.md) About Teramind Teramind is a global leader in workforce analytics, insider threat detection, data loss prevention (DLP), and business process optimization. We help organizations of all sizes protect sensitive data,… [Browse all jobs](https://jobicy.com/jobs.md)