Senior Staff GRC Analyst

Diligent Corporation · Vancouver, British Columbia, Canada

// classified as

Other (Adjacent or hard to classify.)

> description

Most security assurance work is reactive: a customer asks, a team scrambles, an answer goes out. This role exists to end that cycle.  As a Senior Staff Analyst, you’ll own a named portfolio of our most significant customers from a security perspective, and get ahead of what they need — their regulatory environment, their audit calendar, their risk appetite, their control expectations — well enough to have the evidence ready before the request arrives. You’ll lead customer security audits hands-on, sit across from customer security teams as a peer rather than a form-filler, and build account security plans that make the next assessment predictable instead of painful.  This is deliberately a hands-on senior individual contributor role. You’ll spend your time in audits, in customer conversations, and in the detail of controls and evidence — not in a management chain. If you’ve got deep SOC 2 and ISO 27001 knowledge, real technical range across cloud architecture, identity and vulnerability management, and the presence to hold a room with a sceptical CISO, this is a portfolio you can genuinely own.  Here’s a breakdown of what you’ll do (not all of it, just the important stuff):  <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="1" data-aria-level="1">Own a portfolio of strategic accounts as their dedicated security point of contact, building durable relationships with their security, risk, compliance and procurement teams.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="2" data-aria-level="1">Lead customer security audits and assessments hands-on — scoping, preparing evidence, running the sessions, defending control design and driving findings to closure with internal owners.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="3" data-aria-level="1">Build and maintain an account security plan for each account: their frameworks and regulators, audit and reassessment cycles, known concerns, open items and the roadmap commitments they care about.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="4" data-aria-level="1">Anticipate requirements before they’re raised, tracking regulatory change, industry expectations and each account’s compliance calendar so documentation and evidence are staged in advance.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="5" data-aria-level="1">Act as the escalation and expertise layer for complex assurance work — bespoke questionnaires, contractual security terms, incident and vulnerability inquiries, penetration tests and architecture-level questions.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="" data-font="Symbol" data-listid="1" data-aria-posinset="6" data-aria-level="1">Partner with Sales, Customer Success and Renewals as the embedded security resource, and feed what you learn back into the security and compliance roadmap, the shared answer library and trust site content.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> These are the essentials you’ll need to get an interview:  <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="1" data-aria-level="1">5+ years in security GRC, customer assurance, security consulting, IT audit or a closely related function, with meaningful time spent customer- or client-facing.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="2" data-aria-level="1">Direct hands-on experience leading or defending security audits and assessments, on either side of the table.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="3" data-aria-level="1">Deep working knowledge of SOC 2 and ISO 27001, plus the adjacent expectations strategic customers raise — NIST CSF, GDPR, HIPAA, DORA and sector-specific requirements.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="4" data-aria-level="1">Genuine technical depth: you can discuss cloud architecture, encryption, identity, logging and vulnerability management with a customer’s security engineers without taking every question away.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="5" data-aria-level="1">Excellent written communication, especially the ability to write precisely about controls for an expert audience.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="6" data-aria-level="1">The judgment and presence to hold a room with a sceptical CISO, say “we don’t do that today, here’s why and here’s what we do instead,” and keep the relationship intact.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="2" data-aria-posinset="7" data-aria-level="1">A demonstrated bias toward anticipation over reaction — evidence you’ve built something that prevented fire drills rather than just handling them well.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul>   It would be great if you had these to, but we’ll support you if you don’t:    <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="1" data-aria-level="1">Prior experience in a GRC analyst, customer security officer, or named account security or customer success role.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="2" data-aria-level="1">Experience in financial services, healthcare or the public sector, or supporting customers in heavily regulated industries.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="3" data-aria-level="1">Certifications such as CISSP, CISA, CRISC or ISO 27001 Lead Auditor.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="4" data-aria-level="1">Familiarity with trust center platforms and AI-assisted assurance tooling.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="5" data-aria-level="1">Experience in a multi-product SaaS environment where certifications and control boundaries differ by product.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul> <ul> <li data-leveltext="●" data-font="Noto Sans Symbols" data-listid="5" data-aria-posinset="6" data-aria-level="1">Comfort with occasional travel for on-site customer audits and executive reviews.<span data-ccp-props="{"335551550":6,"335551620":6,"335559739":120,"335572071":0,"335572072":0,"335572073":4278190080,"335572075":0,"335572076":0,"335572077":4278190080,"335572079":0,"335572080":0,"335572081":4278190080,"335572083":0,"335572084":0,"335572085":4278190080,"335572087":0,"335572088":0,"335572089":4278190080,"469789798":"nil","469789802":"nil","469789806":"nil","469789810":"nil","469789814":"nil"}"> </li> </ul>   <div class="content-conclusion">About Us Diligent is the AI leader in governance, risk and compliance (GRC) SaaS solutions, helping more than 1 million users and 700,000 board members to clarify risk and elevate governance. The Diligent One Platform gives practitioners, the C-Suite and the board a consolidated view of their entire GRC practice so they can more effectively manage risk, build greater resilience and make better decisions, faster.  <div>At Diligent, we're building the future with people who think boldly and move fast.  Whether you're designing systems that leverage large language models or part of a team reimaging workflows with AI, you'll help us unlock entirely new ways of working and thinking.  Curiosity is in our DNA, we look for individuals willing to ask the big questions and experiment fearlessly - those who embrace change not as a challenge, but as an opportunity.  The future belongs to those who keep learning, and we are building it together.  At Diligent, you’re not just building the future - you’re an agent of positive change, joining a global community on a mission to make an impact.</div> Learn more at diligent.com or follow us on <a id="OWA170dad44-6a69-e1e1-d720-601cd59ec77c" class="x_x_x_OWAAutoLink" href="https://www.linkedin.com/company/diligent-board-member-services/mycompany/verification/" data-outlook-id="c606bc91-5052-4d3a-a1d1-ed00ede365d9" data-linkindex="1" data-auth="NotApplicable">LinkedIn</a> and <a id="OWA153deb8c-7641-f6fc-97cb-65df680002a3" class="x_x_x_OWAAutoLink" href="https://www.facebook.com/DiligentCorporation/" data-outlook-id="07f4e461-6294-4482-a624-e58c27cd6199" data-linkindex="2" data-auth="NotApplicable">Facebook</a>   What Diligent Offers You  <ul> <li>Creativity is ingrained in our culture. We are innovative collaborators by nature. We thrive in exploring how things can be differently both in our internal processes and to help our clients</li> <li>We care about our people. Diligent offers a flexible work environment, global days of service, comprehensive health benefits, meeting free days, generous time off policy and wellness programs to name a few</li> <li>We have teams all over the world. We may be headquartered in New York City, but we have office hubs in Washington D.C., Vancouver, London, Galway, Budapest, Munich, Bengaluru, Singapore, and Sydney.</li> <li>Diversity is important to us. Growing, maintaining and promoting a diverse team is a top priority for us. We foster and encourage diversity through our Employee Resource Groups and provide access to resources and education to support the education of our team, facilitate dialogue, and foster understanding.</li> </ul> Diligent created the modern governance movement. Our world-changing idea is to empower leaders with the technology, insights and connections they need to drive greater impact and accountability – to lead with purpose. Our employees are passionate, smart, and creative people who not only want to help build the software company of the future, but who want to make the world a more sustainable, equitable and better place.  Headquartered in New York, Diligent has offices in Washington D.C.,  London, Galway, Budapest, Vancouver, Bengaluru, Munich, Singapore and Sydney.   To foster strong collaboration and connection, this role will follow a hybrid work model. If you are within a commuting distance to one of our Diligent office locations, you will be expected to work onsite at least 50% of the time. We believe that in-person engagement helps drive innovation, teamwork, and a strong sense of community.   Diligent is proud to be an equal opportunity employer. We do not discriminate based on race, color, religious creed, sex, national origin, ancestry, citizenship status, pregnancy, childbirth, physical disability, mental disability, age, military status, protected veteran status, marital status, registered domestic partner or civil union status, gender (including sex stereotyping and gender identity or expression), medical condition (including, but not limited to, cancer related or HIV/AIDS related), genetic information, or sexual orientation in accordance with applicable federal, state and local laws. We also consider qualified applicants regardless of criminal histories, consistent with legal requirements. See also Diligent's <a href="https://www.diligent.com/company/eeo-policy" data-auth="NotApplicable" data-outlook-id="5e90c823-c220-4ada-92af-0b9df69068d6" data-linkindex="4">EEO Policy</a> and <a href="https://www.diligent.com/-/media/project/diligent/master/eeo-is-the-law-poster-eeocselfprintposter-and-ofccp-supplement-from-20170719.pdf?rev=96fafda8-f51d-44b6-a380-9af42898f526&hash=614AE342F4AB51A091EA3E15F84F7E49" data-auth="NotApplicable" data-outlook-id="25527b37-a96e-4ef3-af1f-248e2a881a45" data-linkindex="5">US EEOC</a><a href="https://www.diligent.com/-/media/project/diligent/master/eeo-is-the-law-poster-eeocselfprintposter-and-ofccp-supplement-from-20170719.pdf?rev=96fafda8-f51d-44b6-a380-9af42898f526&hash=614AE342F4AB51A091EA3E15F84F7E49" data-auth="NotApplicable" data-outlook-id="25527b37-a96e-4ef3-af1f-248e2a881a45" data-linkindex="6">’</a><a href="https://www.diligent.com/-/media/project/diligent/master/eeo-is-the-law-poster-eeocselfprintposter-and-ofccp-supplement-from-20170719.pdf?rev=96fafda8-f51d-44b6-a380-9af42898f526&hash=614AE342F4AB51A091EA3E15F84F7E49" data-auth="NotApplicable" data-outlook-id="25527b37-a96e-4ef3-af1f-248e2a881a45" data-linkindex="7">s Know Your Rights</a>. We are a drug free workplace.  We are committed to providing reasonable accommodations for qualified individuals with disabilities and disabled veterans in our job application procedures. If you need assistance or an accommodation due to a disability, you may contact us at recruitment@diligent.com.  <div>To support a fair and consistent hiring process, we use AI and digital automated tools to assist our recruitment team in organizing candidate data, surfacing relevant applications, coordinating interview scheduling and summarizing interview notes. All final screening, evaluation, and hiring decisions are made by humans on our team. To learn more about how we collect, protect, and process your information, please review our <a href="https://www.diligent.com/legal/candidate-privacy" data-auth="NotApplicable" data-outlook-id="48c7a45d-2b3c-4bc9-99ec-639351abe71c" data-linkindex="8">Candidate Privacy Policy</a>.  </div> <div>At Diligent, we recognize the value of a diverse global workforce. Visa sponsorship may be available for select positions based on business needs and specific role requirements. Sponsorship decisions are evaluated on a case-by-case basis, and eligibility should not be assumed for all opportunities. </div> <div> </div> <div>Recruitment agencies: Diligent does not accept unsolicited agency resumes. Please do not forward resumes to our jobs alias, Diligent employees or any other organization location. Diligent is not responsible for any fees related to unsolicited resumes</div></div>