Security GRC Analyst (SOC 2 / ISO 27001)
Security controls, evidence and questionnaires ready for auditors and customers
The Security GRC Analyst maps controls to SOC 2 and ISO 27001, collects evidence on schedule, runs internal control checks, and answers customer security questionnaires from approved answers.
The security leader approves answers and policies; the independent auditor forms its own opinion. The analyst never represents a control as operating when evidence is missing.
AI drafts; a named person approves.
The SOC 2 report itself is class C: it is issued only by a licensed CPA firm, and ISO 27001 certification only by an accredited certification body. This role prepares evidence for them.
This seat is built and can be switched on for your business as a free evaluation. It is not for sale and has no price yet. Ask below; a person reviews every request and replies by email. Nothing is charged.
SARA is our AI assistant. Calls are recorded.
Morning: collects this month's access-review evidence. Midday: answers a customer security questionnaire from the answer bank. Afternoon: follows up on a missing vendor review. Pre-audit: readiness report to the security lead.
- ·Map controls to frameworks
- ·Collect control evidence on schedule
- ·Run internal control checks
- ·Answer security questionnaires from approved answers
- ·Coordinate with the external auditor
- ●Evidence collected on schedule
- ●Audit exceptions
- ●Questionnaire turnaround time
- · SaaS companies selling to enterprise
- · Service providers handling client data