GRC & Security Assurance Analyst

We are looking for a highly organized and strategic Governance, Risk, and Compliance (GRC) Specialist to own our day-to-day security posture and act as the bridge between our engineering team and our enterprise clients. In this role, you will not just check compliance boxes; you will act as a critical sales enabler. You will leverage our compliance automation platform (Scrut) to maintain our SOC 2 and GDPR posture while simultaneously taking ownership of enterprise Vendor Risk Assessments (VRAs) to help us close deals faster.

The core responsibilities for the job include the following:

Sales Enablement and Client Trust (External):

• Take primary ownership of completing enterprise security questionnaires, RFPs, and Vendor Risk Assessments (VRAs) accurately and efficiently.
• Build and maintain a centralized security knowledge base/Trust Center to streamline standard responses for the sales team.
• Join prospective client calls alongside the sales team to confidently explain Skimas cloud architecture, data segregation, and security controls to external IT and security stakeholders.
• Assist in reviewing and negotiating Data Processing Agreements (DPAs) and vendor security exhibits.

Continuous Compliance and Automation (Internal):

• Oversee daily operations of the compliance automation platform.
• Monitor integrations across cloud, MDM, and HR systems to ensure smooth evidence collection.
• Investigate and resolve control failures or alerts in collaboration with engineering and DevOps teams.
• Ensure adherence to internal policies such as access control, data retention, and backup.

Audit and Risk Management:

• Act as the primary internal project manager for our annual SOC 2 Type II audits, facilitating asynchronous evidence review with our external CPA firm via Scrut.
• Lead annual risk assessments, tabletop incident response exercises, and vendor due diligence reviews.
• Stay updated on emerging global AI and data privacy regulations (e. g., EU AI Act, GDPR updates) to ensure the Skima platform remains ahead of regulatory curves.

Requirements:

• Experience: 4 to 6 years of experience in Information Security, IT Audit, or GRC within a modern B2B SaaS environment (preferred).
• Compliance Frameworks: Strong foundational knowledge of SOC 2 and GDPR. Experience with ISO 27001 or HIPAA (not mandatory) is a plus.
• Automation Tooling: Hands-on experience managing compliance via automation platforms (Scrut, Vanta, Drata, Secureframe, or similar ones work).
• Technical Fluency: Ability to understand and intelligently discuss modern cloud architectures (basic knowledge of any one works) without necessarily needing to write code.
• Communication Skills: Excellent technical translation skills. You must be able to clearly articulate complex security concepts to both highly technical auditors and non-technical business stakeholders.
• Mindset: A solutions-oriented approach. When a client asks for a specific control we don't have, you know how to propose a valid compensating control rather than just saying no.