Note: The job is a remote job and is open to candidates in USA. Shift Technology delivers AI agents and an insurance-grade SaaS platform that transform critical work for insurers. The Senior GRC Analyst will develop and maintain security and privacy governance frameworks, manage compliance and audits, lead risk assessments, oversee third-party security assurance, and support TrustOps and customer due diligence activities.
Responsibilities
• Act as a lead contact to translate Shift’s global information security expectations into actionable policies, standards, and procedures
• Promote a mind-set of security and compliance across the organization, transferring knowledge of standards and acting as a subject matter expert (SME)
• Contribute to the development and support of the security awareness program to ensure it aligns with policy and compliance requirements
• Partner with the Data Protection Officer to develop and maintain privacy policies, data handling standards, and public-facing privacy notices in line with privacy laws and global regulations such as GDPR
• Develop and maintain the security assurance plan, ensuring key controls are effectively designed and implemented to meet Shift policies and standards
• Improve the third-party information security assurance and continuous assessment process
• Identify key risk areas in collaboration with engineering and business teams and facilitate security control evaluations and testing
• Review architectural designs and new initiatives to ensure they align with security policies and effectively mitigate risk
• Proactively identify potential information security GRC problem areas and execute plans to improve the overall assurance workflow
• Support and facilitate Data Protection Impact Assessments (DPIAs) for new products and initiatives
• Manage and coordinate internal and external audits for certifications such as ISO 27001 and SOC 2 Type II
• Perform analysis and compile documentation and evidence to demonstrate the compliance level of systems, services, and controls
• Work with internal teams to manage the remediation of audit findings and track them to closure
• Support legal and stakeholder teams in responding to Data Subject Access Requests (DSARs)
• Develop, execute, and improve the third-party information security assurance and continuous assessment process
• Communicate with third parties and suppliers to conduct risk assessments, review their security posture, and manage the remediation of identified issues
Skills
• 7+ years of proven experience in a GRC, IT Audit, Security Assurance, or Information Security role
• Bachelor's Degree in a relevant field or equivalent work experience
• Direct experience of delivery in highly regulated industries, i.e financial services, healthcare
• Direct experience managing or supporting formal audit and certification processes from start to finish
• Deep knowledge of security and privacy frameworks is required (e.g., ISO 27001, ISO27701, SOC 2 Type II, HITRUST, NIST CSF)
• Strong knowledge of global privacy and healthcare regulations (e.g., GDPR, HIPAA)
• Working knowledge of AI regulations, frameworks, and standards (e.g., EU AI Act, ISO 42001)
• Working knowledge of business continuity, disaster recovery, and incident response planning, including plan structure, exercise and test methodologies
• Exceptional communication and presentation skills, with the ability to translate complex compliance requirements into clear business guidance
• Strong stakeholder management skills with the ability to influence and align teams without direct authority
• Highly organized with strong project management skills, capable of managing multiple audits and assessments simultaneously
• An analytical mindset with the ability to balance regulatory requirements with business objectives and priorities
• Professional certifications such as CIPP/E, CIPP/US, CIPT CISA, CISM, CRISC, or CISSP are highly desirable
• Hands-on experience with modern GRC management tools, preferably Drata - connecting integrations, tuning automated evidence collection and monitoring tests, and building custom controls and frameworks
Benefits
• Flexible remote and hybrid working options
• A variable component tied to personal and company performance
• Multiple Learning and Development opportunities, including Focus Fridays, a half-day each month to focus on learning and personal growth
• Generous PTO and paid holidays
• Mental health benefits
• 2 MAD Days per year (Make A Difference Days for paid volunteering)
Company Overview
• Shift Technology is a provider of AI-driven decision automation and optimization technology for the global insurance industry. It was founded in 2013, and is headquartered in Paris, Ile-de-France, FRA, with a workforce of 501-1000 employees. Its website is http://www.shift-technology.com/.
Company H1B Sponsorship
• Shift Technology has a track record of offering H1B sponsorships, with 1 in 2025, 2 in 2023, 9 in 2022, 5 in 2021, 6 in 2020. Please note that this does not guarantee sponsorship for this specific role.