Senior GRC Analyst

Responsibilities

• Lead end-to-end execution of PCI DSS audits and support internal IT SOX controls
• Develop and maintain data inventory and data flow diagrams for PII and PCI compliance
• Map and implement controls across frameworks like PCI DSS and NIST CSF
• Orchestrate quarterly and semi-annual user access reviews (UAR) across SaaS and Cloud infrastructure
• Manage the Security Awareness Training (SAT) program and monthly phishing simulations
• Execute the Third-Party Risk Management (TPRM) program and vendor security reviews
• Maintain and update the corporate risk register

Requirements

• 3–5 years of experience in GRC, Information Security, or Audit
• Deep practical knowledge of PCI DSS requirements and controls
• Experience with Data Mapping and maintaining Records of Processing Activities (RoPA)
• Experience managing phishing platforms (e.g., KnowBe4, Mimecast)
• Experience with identity governance and formal access review cycles
• Experience administering GRC platforms (Vanta experience is a significant advantage)
• Experience with SOX IT General Controls (ITGCs)
• Demonstrated experience using AI tools to improve GRC workflows

Preferred Qualifications

• Experience in FinTech or Financial Services industry

About the Company

Subsplash is an award-winning team of 280+ mission-driven people building The Ultimate Engagement Platform™ for churches, Christian ministries, non-profits, and businesses around the world.