Sr. GRC Analyst

Subsplash is an award‑winning team of 280+ mission‑driven people committed to humility, innovation, and excellence. Founded in 2005, we pioneered the first church mobile app and now build The Ultimate Engagement Platform™ for churches, Christian ministries, non‑profits, and businesses worldwide, serving 14,000+ clients and millions of users daily. About the Team The IT Team maintains all activities and services that support business functions, ensuring proper security across all IT systems. We deliver robust day‑to‑day technical support and handle essential functions such as access management, user provisioning and deprovisioning, new hardware and software setup, and budget‑controlled subscription spend. About the Role The Senior GRC Analyst acts as a strategic lead to advance security and risk operations. You will integrate people, policy, and technology to drive operational excellence and framework maturity, identify security gaps, implement best practices, and mature our control environment. We are building an AI‑first compliance function, and this role will lead the deployment of AI tools that scale our GRC program. Compensation The total compensation for this position is between $95,000–$105,000/yr, depending on experience level. Essential Functions of This Role Compliance Program Management & Audit Leadership Audit Execution: Act as the primary point of contact for external auditors; lead the end‑to‑end execution of PCI DSS audits and support internal audit on IT SOX controls. Data Mapping Maintenance: Develop and maintain a comprehensive data inventory and data flow diagrams to track sensitive data (PII, PCI) and ensure compliance with privacy regulations. Framework Maturation: Map and implement controls across multiple frameworks (PCI DSS, NIST CSF) to eliminate redundancies and improve the organization’s security posture. GRC Reporting: Track and report on GRC program health across compliance posture, risk register status, audit readiness, and control effectiveness. Present metrics and trends to leadership on a regular cadence. Access Governance & Identity Management User Access Reviews: Orchestrate and lead the quarterly and semi‑annual user access review process across all critical systems (SaaS, cloud infrastructure, and internal tools). Joiner/Mover/Leaver Oversight: Monitor and validate that provisioning and deprovisioning processes are executed accurately and on time across critical systems. Flag exceptions, track remediation, and maintain documentation to support access control audits. Security Awareness & Phishing Program Program Ownership: Execute and maintain a year‑round Security Awareness Training (SAT) program that meets PCI DSS requirements while driving actual behavioral change. Phishing Simulations: Execute monthly or quarterly phishing simulations; analyze fail rates and provide targeted follow‑up training to high‑risk groups. Content Curation: Select and deploy engaging security content, newsletters, and security moments to keep cybersecurity top‑of‑mind for all employees. Reporting: Present program health metrics (completion rates, simulation trends, and reporting speed) to the leadership team. Risk and Vendor Management Vendor & Risk Execution: Execute the TPRM program—conducting vendor security reviews, tracking remediation to completion, and escalating high‑risk findings to leadership. Risk Register Ownership: Maintain and update the corporate risk register, ensuring remediation efforts are tracked, validated, and communicated to leadership. Desired Qualifications Experience: 3–5 years in GRC, Information Security, or Audit. FinTech or Financial Services industry experience is highly preferred. Technical Mastery: Deep practical knowledge of PCI DSS requirements and controls. Data Governance: Experience performing data mapping exercises and maintaining Records of Processing Activities (RoPA). SAT Strategy: Proven experience managing phishing platforms (KnowBe4, Mimecast, or Vanta‑integrated tools) and developing security training curricula. IAM Expertise: Proven experience managing formal access review cycles and identity governance processes. Systems: Proven experience administering a GRC platform, including automated evidence collection, control monitoring, and access review workflows. Direct experience with Vanta is a significant advantage. SOX IT Controls: Experience with SOX IT General Controls (ITGCs), including change management, logical access, computer operations controls, and segregation of duties (SoD). This role will work directly with internal audit to support IT SOX control testing and evidence collection. AI Tooling: Demonstrated experience using AI tools to improve GRC workflows, automate reporting, or accelerate evidence collection and analysis. Core Competencies Critical Thinker: Ability to distinguish clear priorities and conclusions from ambiguous data. Velocity: Bring urgency and momentum to compliance work—prioritizing ruthlessly and moving quickly through ambiguity. Detail Oriented: Notice the small gaps in access logs, data maps, or training reports that others might miss. AI‑Forward: Treat AI as a force multiplier for GRC work—using it to compress audit prep cycles, automate evidence gathering, and free up capacity for higher‑value risk analysis. Collaborative: Work effectively across IT and Engineering to surface control gaps, translate technical risks into compliance language, and ensure cross‑functional ownership of remediation. Your First 90 Days Own the PCI DSS evidence pipeline—be fully oriented on the current ASV scanning cadence, open findings, and SAQ scoping in Vanta, and develop a plan for full ownership. Get oriented on the SOX SoD review cycle—develop a working understanding of the quarterly review rhythm, supporting Confluence documentation, and compensating controls tracking process. Complete a full User Access Review cycle—execute a complete user access review across all critical systems, coordinate with IT and system owners, document exceptions, and track remediation to closure. Deliver a first GRC metrics report to leadership—produce a polished metrics report covering compliance posture, risk register status, PCI standing, and SOX control health. Location This is a 100% remote position for candidates residing in the United States. The role is available only to individuals currently residing in one of the following states: AL, AR, AZ, CO, FL, GA, ID, IA, IN, KS, KY, MO, MI, MN, NC, NM, OK, OH, OR, SC, SD, TN, TX, UT, VA, WA, WY We are not sponsoring relocation for this role. Benefits Generous Paid Time Off, Medical, Dental, Vision, Short and Long‑Term Disability, Life Insurance, Competitive Compensation, 401(k) Matching, Professional Development, Top‑of‑the‑Line Equipment, Referral Program, Parental Leave, Family‑Friendly Culture. Legal Employment with Subsplash is contingent upon satisfactory proof of the employee’s right to work in the U.S., as required by law and upon completion of a basic background check. Employment with Subsplash is considered “at will.” EEO Statement Subsplash is an Equal Opportunity Employer. We value all human life as all people are created with equal dignity, value, and worth. We do not discriminate on the ground of race, color, religion, sex, age, disability or national origin, or genetic information in the hiring, retention, or promotion of employees; nor in determining their rank, or the compensation or fringe benefits paid them. #J-18808-Ljbffr