GRC Analyst

Vercel is looking for a GRC Analyst to join its Governance, Risk and Compliance team. You will manage and maintain ongoing compliance with security and privacy frameworks, policies, procedures, and commercial assessments, including ISO 27001, SOC 2, HIPAA, and PCI DSS. You will collaborate with cross-functional teams to promote a culture of accountability and integrity throughout the organization, reporting to the Head of GRC.

Responsibilities

• Collaborate with internal teams to maintain an effective suite of internal controls, driving remediation efforts to completion with clear documentation of progress.
• Build strong working relationships across the business so compliance accountability is shared and stakeholders stay informed.
• Streamline annual audits by managing audit deliverables, developing treatment plans, and coordinating across teams to track completion.
• Monitor and improve controls, processes, and evidence management practices, identifying opportunities to automate and streamline GRC operations and contributing to controls maturity scoring.
• Enable go-to-market teams and accelerate deal cycles by supporting security questionnaires, addressing compliance inquiries, and maintaining customer-facing documentation on Vercel's security and compliance posture.
• Design and manage company training on compliance, ethics, and regulatory requirements for internal stakeholders.

Qualifications

• At least 3 years of experience supporting the audit lifecycle in a cloud-centric environment (SOC 2, ISO 27001, PCI, HIPAA), with the organizational skills to stay flexible and proactive in a high-growth environment.
• Experience collaborating closely with internal partners to incorporate policies and technical controls into the SDLC.
• Strong project management skills and sense of ownership, with the ability to communicate, collaborate, and execute projects across business units and levels.
• Bonus: experience with cloud infrastructure (Azure, AWS), familiarity with tools like Drata, Linear, or Datadog, or certifications such as CISM, CISSP, or CCEP.