GRC Analyst

FloQast is looking for a Risk & Controls Manager to join our growing InfoSec & Compliance department. This role serves as a risk and controls advisor, ensuring adherence to key compliance frameworks across the organization, and evaluating business initiatives from a risk and controls perspective to help ensure that FloQast's operations, products, and services remain aligned with regulatory, contractual, and internal requirements. This role will own several core risk domains, including privacy, third-party risk management, and policy management, and will also contribute to broader risk program initiatives, including issue management and process automation. We are looking for a well-rounded GRC professional who can operate across multiple risk and compliance domains, with the scope of this role expected to evolve as the needs of the department grow. The InfoSec & Compliance department at FloQast reports directly to the General Counsel and is responsible for ensuring FloQast manages risk and maintains compliance with an array of frameworks covering security, privacy, AI, and financial reporting. We are a team of in-house subject matter experts who advise, direct, train, and monitor the organization, resulting in daily interactions with all departments on a variety of unique and interesting business initiatives. This role has a requirement of working in office 3 days per week, which may be subject to change based on team and business needs, as determined by the department leader. Please note that this requirement is subject to ongoing review and may be adjusted in the future. *Visa sponsorship is NOT available at this time

What You'll Do

Manage FloQast's internal controls inventory as new controls are added and existing controls are changed Build upon the controls inventory to ensure control owners, testing procedures, related policies, and other pertinent information is accurately documented and kept up to date Work with control owners to ensure process narratives are documented and updated annually for all controls Initiate, monitor, and follow up on monthly and quarterly control activities to ensure they are completed on time and proper evidence is documented to meet audit requirements. Serve as a trusted advisor and advocate for security and compliance, engaging with teams across the company to foster a strong risk-aware culture. Facilitate the development and maintenance of policies, standards, processes, and guidelines by drafting the documentation update, gathering the appropriate approvals, and reporting on all changes in policy review meetings. Support annual internal and external ISO 27001, ISO 27701, ISO 42001 SOC 1, SOC 2, and other similar audits by scheduling audit interviews, submitting evidence requests to control owners, following up as needed to obtain evidence on time, reviewing evidence provided for accuracy, and facilitating follow up requests as needed to ensure our audits remain on schedule. Aggregate identified internal control issues and perform a root cause analysis and collaborate on remediation efforts Be an advocate for compliance best practices and the point of contact for stakeholders from departments throughout the company Support customer assurance activities, including completion of security questionnaires and participation in customer discussions. Participate in and contribute to cross-functional project teams Any other tasks that may be assigned to help the company meet its goals