Apply on Employer Site

Rillet · 23 hours ago

Senior GRC Analyst

New York, NY

Full-time

Hybrid

Senior Level

5+ years exp

Rillet is a high-growth fintech company that serves finance teams by providing AI-native ERP solutions. As a Senior GRC Analyst, you will establish the governance, risk, and compliance program, focusing on SOC 2 Type II certification and building scalable compliance processes to support product velocity.

AccountingArtificial Intelligence (AI)Enterprise Resource Planning (ERP)FinanceFinancial ServicesFinTechSaaS

Responsibilities

Own and drive our SOC 2 Type II and SOC1 Type II certifications from scoping through audit completion, establishing controls that scale with our hypergrowth while maintaining our legendary shipping velocity

Build Rillet's compliance program including policies, procedures, and control frameworks for SOC 2, ISO 27001, GDPR, SOC 1 and financial services regulations, creating documentation that passes auditor scrutiny and actually gets used by the team

Partner with engineering leadership to implement secure development practices, conduct risk assessments, and embed security requirements into the product roadmap without becoming a bottleneck

Enable enterprise sales by leading customer security assessments, managing the security questionnaire process, and providing the documentation and confidence that closes seven-figure deals faster

Monitor and manage risk across our infrastructure, vendors, and operations, building automated compliance monitoring that gives real-time visibility into our security posture

Qualification

SOC 2 Type II certificationISO 27001 certificationSecurity complianceRisk assessmentsCloud securityEntrepreneurial mindsetCommunication skills

Required

5+ years of experience in GRC, security compliance, or information security roles, with at least 2 years leading SOC 2 or ISO 27001 certification efforts

Hands-on experience successfully completing SOC 2 Type II audits, ideally at a high-growth B2B SaaS or fintech company handling sensitive data

Deep understanding of security frameworks (SOC 2, ISO 27001, NIST CSF) and data privacy regulations (GDPR, CCPA), with the ability to translate requirements into practical controls

Technical fluency to collaborate effectively with engineering teams on security architecture, vulnerability management, and cloud security (AWS/GCP/Azure)

Track record of building compliance programs that enable fast product iteration rather than slowing teams down, with a bias toward automation and scalable processes

Exceptional communication skills with the ability to translate complex security concepts for executives, engineers, and customers alike

Entrepreneurial mindset with extreme ownership—you don't need a playbook or a large team, you build what needs to exist