SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 175,000 - 190,000 / annual
Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to execute and operate compliance programs during a pivotal growth phase. Reporting to the Director of GRC, you will work across commercial certifications (SOC 2 Type II, ISO 27001, 27701, and 42001) and the FedRAMP program, while supporting vendor risk management and customer security assurance.
This is a hands-on execution role focused on operational delivery. You will partner with Staff GRC Analysts who set certification strategy and own the operational execution: collecting evidence, testing controls, running audit cycles, assessing vendors, and answering customer security questions. You will also have a mandate to automate compliance work using Tines itself.
Key responsibilities include:
• Certification and Audit Execution: Drive audit cycles end-to-end for SOC 2 Type II and ISO 27001/27701/42001, including evidence collection, control testing, auditor liaison, and remediation tracking. Support gap assessments for new certifications.
• FedRAMP Program Support: Support FedRAMP efforts including gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors.
• Continuous Control Monitoring: Operate year-round monitoring cadence to keep certifications live between audits—scan and pen test reporting, control drift detection, and evidence freshness.
• Vendor Risk Management: Run vendor security assessments, evaluate security controls and compliance posture, and help mature the third-party risk program.
• Risk Assessment and Management: Conduct risk analyses for systems, processes, and third-party applications; implement appropriate controls to mitigate identified risks.
• Customer Security Assurance: Respond to customer security inquiries, questionnaires, and audit requests; support Sales on RFPs and RFQs; maintain Trust Center documentation.
• Contract Review and Management: Partner with Legal to review contracts for security and compliance requirements, ensure appropriate security provisions, identify compliance risks, and develop standardized security language.
• Compliance Automation: Use Tines to streamline compliance processes, evidence collection, and reporting.
• Policy Development and Maintenance: Review, update, and develop security policies and procedures aligned with regulatory requirements and industry best practices.
• Cross-functional Collaboration: Partner with Engineering, Product, IT, Legal, HR, and leadership to embed compliance requirements into organizational processes.
• Regulatory Monitoring: Stay current with evolving compliance standards and regulatory requirements.
Tines is the intelligent workflow company powering critical workflows for customers including Canva, Reddit, SAP, Coinbase, Mars, Fin (Intercom), and McKesson. Tines 3B, launched in 2026, is the next generation—a single, secure environment for every team's apps, agents, and automations. The company is vendor-agnostic, integrating with any API-enabled service, with security woven into its DNA.
REQUIREMENTS:
• 8–12 years of experience in IT compliance, security, or risk management
• Hands-on experience implementing or maintaining ISO 27001 compliance
• Strong knowledge of SOC 2 compliance frameworks and audit processes, including evidence collection and control testing
• Experience supporting FedRAMP certification processes and requirements
• Experience conducting vendor security assessments and risk analyses
• Excellent understanding of information security principles, controls, and best practices
• Strong project management skills with ability to manage multiple compliance initiatives simultaneously
• Exceptional communication skills for translating technical requirements to non-technical stakeholders
• Previous experience on the audit side (at a 3PAO or audit firm such as Coalfire, Schellman, KPMG) or driving gap remediation for certification readiness
• Industry certifications such as CISSP, CISA, or CISM (preferred)
• Experience with compliance automation tools and techniques, or scripting/API experience for evidence automation
• Continuous monitoring (ConMon) and compliance reporting experience
• Knowledge of cloud security principles and controls (AWS, Azure, GCP)
• Experience reviewing contracts for security and compliance requirements
• Experience in SaaS or technology companies
• Familiarity with privacy regulations (GDPR, CCPA)
• Experience working in remote-first environments
Applicants must be authorized to work for any employer in the U.S. Visa sponsorship is not available.
