Senior GRC Analyst

Gusto · San Francisco, CA - Hybridsenior

In short

▸Analista Sênior de GRC enfocado en automatización con IA para cumplimiento (SOC 2, control de terceros)
▸Gestiona políticas, riesgos, auditorías externas y colabora con equipos de seguridad, legal e ingeniería
▸Destaca el uso de agentes de IA para mejorar la eficiencia en la recopilación de evidencias y gestión de controles

Proficiency in English required for collaboration and documentation.

In ~1 minute you get: who interviews you, the likely questions answered from your CV, and your CV tailored to this job. Free, no card.

What they ask for

✓8+ años en GRC en empresas SaaS, preferentemente en HCM, nómina o fintech
✓Experiencia probada en iniciativas de cumplimiento SOC 2 Type 2 con auditorías externas
✓Conocimiento en frameworks de cumplimiento (ICOC, ITGC, etc.) y control de terceros
✓Habilidades para liderar procesos de riesgo interdepartamentales y gestión de auditorías
✓Familiaridad con herramientas como Optro, Vanta, Drata, Viso Trust o similares
✓Capacidad para implementar políticas de gobernanza de datos y clasificación

Don't tick every box? That's normal — your free dossier shows your gaps and how to cover them in the interview.

SOC 2 Type 2IT General ControlsICOCOptroVantaDrataViso TrustAI agentsTrust management platformsSOPs

Who should you write to at Gusto?

Your free dossier identifies the people who'd interview you — their background, what they value, and how to reach out so you stand out before applying.

About Gusto At Gusto, we're on a mission to grow the small business economy. We handle the hard stuff — payroll, health insurance, 401(k)s, and HR — so owners can focus on their craft and their customers. With teams in Denver, San Francisco, and New York, we support more than 500,000 small businesses nationwide and are building a workplace that reflects the people we serve. All full-time employees receive competitive base pay, benefits, and equity (RSUs) — because everyone who helps build Gusto should share in its success. Offer amounts are determined by role, level, and location. Learn more about our Total Rewards philosophy . AI is a fundamental part of how work gets done at Gusto. We expect all team members to actively engage with AI tools relevant to their role and grow their fluency as the technology evolves. AI experience requirements vary by role and will be assessed during the interview process. About the Role: Gusto is seeking a Security, Governance, Risk & Compliance professional to join our team managing our security governance, risk and compliance initiatives. This person will guide the company from foundational Governance, Risk & Compliance (GRC) maturity through to steady-state operations, leveraging AI to automate and improve old practices and tools, ensuring ongoing compliance with SOC 2 Type 2, IT General Controls, ICOC and related frameworks, while embedding security-minded practices throughout Gusto. This is a cross-functional role with key touchpoints in every department. Here’s what you’ll do day-to-day: • Develop, maintain, and ensure adherence to security and compliance SOPs, internal documentation, and company-wide policies—particularly supporting SOC 2 and future framework adoption. • Own and manage trust management platforms including documentation of controls, risks, vendors, and exceptions, and lead the implementation of AI agents to automate and improve the implementation of our controls framework and evidence collection to support it • Collaborate with Legal, Enterprise Applications, and Gusto counterparts to establish and maintain data governance policies (e.g., classification, retention, handling). • Conduct ongoing internal risk assessments to identify exposure and control gaps; coordinate remediation plans with functional teams. • Manage the third-party vendor risk program, including onboarding reviews, monitoring, and renewal assessments. • Lead interactions with external auditors and regulatory bodies during compliance assessments (e.g., SOC 2 Type 2) and oversee responses to client security assessments and due diligence requests. • Stay current on relevant compliance frameworks, laws, and regulations to ensure appropriate coverage and adaptability. • Partner cross-functionally (e.g., Security, Legal, Engineering, Sales, IT) to implement scalable GRC processes, harmonize systems, and foster GRC understanding through employee enablement programs and KPI-driven insights. Here’s what we're looking for: • 8+ years of experience in governance, risk, and compliance within SaaS, ideally in the HCM, payroll, or fintech sectors. • Bachelor’s degree in Business, Information Systems, or a related field. • Strong understanding of SaaS business models, with experience implementing controls and policies in fast-paced, product-driven environments. • Proven experience leading or supporting a SOC 2 Type 2 compliance initiative, including collaboration with auditors and cross-functional teams. • Familiarity with compliance tools and platforms such as Optro, Vanta, Drata, Viso Trust, or similar. • Demonstrated ability to tran

Don't apply unprepared

We research who's interviewing you, tailor your CV and rehearse you live — first one free.