Senior GRC Analyst

ABOUT BLACK KITE

Black Kite is the global leader in third-party cyber risk intelligence, trusted by more than 3,000 organizations worldwide. We give security and business leaders a continuous, outside-in view of their entire vendor ecosystem — translating complex cyber, financial, and compliance signals into clear, actionable risk intelligence.

We go beyond open standards-based cyber ratings. Black Kite helps organizations make smarter risk decisions, strengthen business resilience, and scale their third-party cyber risk management programs in an increasingly complex digital environment. Our work has earned consistent recognition from customers and industry analysts alike.

WHY BLACK KITE

We’re a fast-moving, high-impact team solving one of the most critical challenges in cybersecurity today. If you’re looking to do meaningful work alongside sharp, collaborative people — and grow your career in a space that matters — you’re in the right place.

THE OPPORTUNITY

The Senior GRC Analyst reports to the Director of Information Security and owns three primary functions: the compliance platform (Vanta), inbound customer security assessments, and FedRAMP ConMon execution support. This is an independent practitioner role — direction comes from the Director, but you own your work without step-by-step guidance.

The "Senior" in this title is earned by the scope, not just the experience level. Owning the compliance platform means auditors see your work directly. Owning customer assessments means your responses are read by enterprise security teams before they sign. Supporting FedRAMP ConMon means authorization status depends in part on what you produce monthly. The stakes are real.

WHAT YOU’LL OWN

Compliance platform (Vanta) — primary owner

• Own the compliance platform end-to-end: evidence library currency, control mapping accuracy, framework completeness across SOC 2, ISO 27001, FedRAMP, and GDPR
• Evidence is current year-round — not assembled at audit time; no stale or missing evidence in any active certification domain

Customer security assessments — primary owner

• Own the inbound customer assessment intake and response process — all RFPs and security questionnaires are assigned, tracked, and responded to within defined SLA
• Collaborate with sales, legal, and technical teams on complex questionnaire responses; escalate novel or sensitive items to the Director
• Maintain and improve the questionnaire response library across all active frameworks

FedRAMP ConMon — execution support

• Support monthly ConMon reporting — vulnerability scan results, POA&M updates, and evidence — as primary executor
• Maintain POA&M tracking accuracy; flag aging items to the Director before they breach defined thresholds

TPCRM and compliance support

• Support third-party risk identification, assessment, and monitoring activities as directed
• Monitor compliance framework and regulatory changes; assess impact and surface findings to the Director with a recommended response
• Support internal audit processes — evidence coordination, control testing documentation, and auditor request responses

WHAT YOU BRING

• 2–4 years of hands-on experience in GRC, compliance, or information security
• Practical working knowledge of SOC 2, NIST, or ISO 27001 applied in a real compliance environment
• Experience producing compliance evidence, contributing to audit cycles, or managing specific framework control domains independently
• Familiarity with cloud services principles and their security and compliance implications
• General knowledge of core security domains: network security, email security, endpoint protection, vulnerability scanning, access controls, log management
• Strong written communication — audit-ready documentation produced independently

PREFERRED

• Hands-on experience administering Vanta or an equivalent compliance platform as a primary owner — not just a user
• Direct experience with FedRAMP ConMon — monthly reporting, POA&M tracking, evidence production
• Experience owning or significantly contributing to a customer security questionnaire response program
• Familiarity with TPCRM programs and vendor questionnaire workflows
• Active or in-progress certification: CompTIA Security , CISA, CRISC, ISO 27001 Lead Auditor/Implementer, or equivalent

The expected base salary range for this role is $95,000-$110,000 per year. Compensation at Black Kite is more than just base pay — we offer a total rewards program that includes performance-based bonuses, equity, flexible healthcare options, paid time off, and retirement savings programs. The annual base salary range for this position represents a nationwide market range and reflects a broad spectrum of salaries for this role across the United States. Actual compensation will depend on factors such as qualifications, skills, experience, and the scope, complexity, and location of the role.