SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 131,000 - 164,000 / annual
Turo, the world's largest car-sharing marketplace, is seeking a Senior Security GRC Analyst to lead security compliance programs as a senior individual contributor within the Enterprise Security team. This role carries primary ownership of SOC 2 Type II and PCI DSS audit readiness and serves as the connective tissue between Engineering, IT, Finance, Legal, and business control owners.
Key Responsibilities:
Security Compliance & Audit Readiness: Own the compliance calendar and drive end-to-end audit readiness for SOC 2 Type II and PCI DSS, including scoping, control mapping, and continuous readiness between audit cycles. Coordinate evidence collection across Engineering, IT, Finance, and business teams; track control owners and close gaps ahead of audit windows. Serve as the primary day-to-day liaison with external auditors and assessors to manage requests, facilitate walkthroughs, and coordinate remediation of findings. Maintain and evolve the common control framework by mapping controls across SOC 2, PCI DSS, and other applicable standards; identify and eliminate redundant testing. Lead compliance testing activities, document results, and maintain evidence repositories supporting internal review and external audit.
Findings, Remediation & Exception Management: Track open audit findings and remediation commitments; provide status reporting to Security leadership and stakeholders. Manage the security exception process, document risk acceptances, obtain appropriate approvals, and monitor exceptions through expiration or remediation. Identify control gaps proactively and partner with control owners to design and implement compensating or corrective controls.
Policy & Governance: Develop, maintain, and enforce security policies, standards, and procedures; keep them current with regulatory change and evolving business needs. Partner with Legal on data-privacy obligations, subprocessor reviews, and breach-notification readiness. Establish and report on compliance metrics—audit readiness scores, open findings aging, exception inventory, and cycle time—to drive accountability and visibility. Identify and implement process and automation improvements that increase throughput and reduce manual effort across compliance workflows.
The role requires driving complex security compliance workstreams with limited oversight, exercising strong judgment and cross-functional influence to keep Turo audit-ready year-round. This is a hybrid role requiring in-office presence three days per week (Mondays, Wednesdays, Thursdays).
Requirements:
- 5+ years in security compliance, GRC, or IT audit, with hands-on experience running security audit programs from start to finish
- Direct ownership of at least one full audit cycle under SOC 2 Type II and/or PCI DSS—from scoping through final report
- Demonstrated ability to coordinate evidence collection and remediation across multiple engineering and business teams with limited oversight
- Working knowledge of cloud security (AWS), IAM, and encryption frameworks—sufficient to assess controls and evaluate evidence critically
- Strong written and verbal communication skills; able to translate technical compliance requirements into clear guidance for non-security stakeholders
- Comfort operating independently in an ambiguous, fast-moving environment, managing competing deadlines without close supervision
- Bachelor's degree in Computer Science, Information Security, Information Assurance, or equivalent practical experience
- Relevant certification: CISA, CISM, CISSP, or equivalent security certification
- Experience scaling a security compliance program through initial certification and into annual renewal cycles
- Familiarity with GRC tooling (e.g., Vanta, Drata, ZenGRC) and security-automation platforms
- Experience in a regulated or high-trust industry—fintech, marketplace, or SaaS handling sensitive personal or financial data
