Staff Security GRC Analyst

Job summary

Responsibilities

We're looking for a Staff Security GRC Analyst to build Suno's security compliance program from the ground up. You'll report to our CISO, work alongside our AppSec and InfraSec teams, and own the control framework that ties everything together: which controls we have, how they map to SOC 2 and…

• Build and own Suno's security control framework, mapping controls to SOC 2, NIST CSF, and future frameworks, and writing control descriptions with the teams who run them.
• Lead SOC 2 preparation end to end, from gap assessments and readiness tracking to driving remediation with control owners and working with our external auditor.
• Automate evidence collection and control monitoring with scripts, integrations, and AI tools, deciding where human review stays in the loop.
• Run vendor security reviews, keep our security policies current, and answer customer security questionnaires alongside Product and Legal.
• Partner with the CISO to give leadership and the board a clear, evidence-backed view of our security posture, and lay the foundations of GRC as part of a growing Security team.

What they're looking for

• 7–9 years in GRC, security compliance, or IT audit.
• Hands-on, end-to-end ownership of a security compliance program as its primary owner, ideally including taking a company through its first SOC 2.
• Deep working knowledge of SOC 2 and NIST CSF, including control mapping, audit mechanics (design vs. operating effectiveness, sampling, evidence), and staying current as…
• Enough technical fluency to read a cloud configuration, access setup, or pipeline and judge whether it enforces what the control says. You don't need to write production code.
• Comfort building your own automation with scripts or AI tools.

Tech stack

• AWS
• GCP