GRC Analyst

Description

Upwind is a next-generation Cloud Security Platform that leverages runtime context to identify and prioritize critical risks, providing precise insights and efficient cloud security management. Unlike traditional tools, Upwind uses runtime data proactively for risk prioritization and posture insights, ensuring teams focus on what truly matters. With industry-leading efficiency and eBPF-powered sensors, Upwind delivers comprehensive capabilities, including agentless cloud posture discovery, real-time threat protection, and integrated API security. From misconfigurations to malware defense, Upwind ensures end-to-end, cost-effective cloud infrastructure protection. At Upwind, you’ll have the opportunity to think creatively, explore new ideas, and use your skills to make a meaningful impact on our growth.

Upwind Security is seeking a highly motivated GRC (Governance, Risk, and Compliance) Analyst to join our growing Security & Compliance team. In this role, you will be responsible for supporting the implementation, operation, and continuous improvement of our GRC framework. You will help ensure our organization’s policies, procedures, and controls align with regulatory requirements and industry best practices.

Responsibilities

• Governance: Develop, maintain, and socialize security policies, standards, and procedures aligned with ISO 27001, SOC 2, GDPR, FedRamp and other frameworks.
• Risk Management: Lead the enterprise, product, and vendor risk management programs—including risk assessments, mitigation plans, and risk registers.
• Compliance Readiness: Own and drive security compliance initiatives such as SOC 2 Type II, ISO 27001, and customer audits.
• Third-Party Risk: Build and operate a third-party security review program; work with Procurement and Legal on vendor onboarding and offboarding.
• Audit & Assurance: Prepare evidence, manage internal and external audits, and continuously improve audit readiness posture.
• Training & Awareness: Run the company-wide security awareness and training programs.
• Metrics & Reporting: Develop KPIs and reporting dashboards to track control effectiveness and risk posture for leadership and board-level communication.
• Collaboration: Partner with Legal, Engineering, Product, and IT to ensure compliance is embedded across business processes.
  
  

• 8+ years of experience in GRC, InfoSec, or risk & compliance functions
• Strong understanding of industry standards and frameworks (e.g., SOC 2, ISO 27001, PCI, NIST, GDPR, CIS)
• Experience leading compliance projects and audits end-to-end
• Hands-on experience with GRC tooling and risk management workflows
• Ability to write and communicate security policies, reports, and training in clear, accessible language
• Strong project management skills and stakeholder engagement ability
• Prior experience in a fast-paced startup or SaaS environment - a plus
• Relevant certifications: CISA, CISM, CRISC, or ISO 27001 Lead Implementer/Auditor - a plus