GRC Analyst, Sprout Social

• If you have a propensity for independent work, experience in IT Audit or Compliance, and a desire to implement world-class governance for our partnership ecosystem, we’d love to talk with you!
• 5+ years of combined experience in security, IT audit, risk management, legal, or similar roles supporting a cloud-based environment
• Experience with system/tool administration and a deep understanding of role-based access controls
• Experience with reviewing and interpreting legal documents
• Experience in developing, implementing, and testing controls in support of compliance or privacy frameworks (e.g., SOC 2, SOX, NIST, ISO, CSA, GDPR, etc

Desirable

• Sprout’s Corporate IT team is a combination of adjacent squads working on projects under one umbrella. This unique structure is an exciting opportunity to grow your career in technology with exposure to projects all across our discipline—something you don’t see often in other organizations. It allows us to move quickly and collaborate with minimal friction or red tape
• As a part of this team, you’re also given the space and encouraged to stretch beyond your core function and make a deeper impact on the broader organization. In short, the work you do here matters and you’ll feel that day in and day out
• Create monitoring processes for changes in our social network partners’ terms of service
• Respond to technical assessments from our social network partners
• Pair with other members of the GRC, Legal, and Engineering teams to create, remediate, and monitor a set of internal controls built on the requirements from our social network partners
• Implement access governance over the social networks’ developer portals
• Participate in internal and external audits–testing, maturing, and automating our security controls along the way
• Support our Sales and Success teams in assuring customers of our industry-leading security and privacy posture with your knowledge of cybersecurity and procurement
• Within 1 month, you’ll plant your roots, including:
• Complete Sprout’s New Hire training program alongside other new Sprout team members
• Be introduced to Sprout’s security, compliance, and legal stakeholders across the organization
• Learn our existing tooling and begin understanding the state of our GRC program
• Learn the current state of Partnership Compliance and begin to identify gaps or areas of improvement
• Support and shadow teammates on security assurance requests, completing questionnaires and joining calls with customers
• Receive feedback from the team on your approach to managing and engaging our existing IT audit and compliance workstreams
• Within 3 months, you’ll start hitting your stride by:
• Work with your manager and teammates to create and prioritize quarterly team goals or projects
• Start to understand the breadth and depth of our team’s authority and remit
• Pair with Legal to embed yourself into the product-build lifecycle, reviewing terms and other legal documents, and creating a process for monitoring changes to our social network partners’ terms of service
• Create internal controls, mapping them to our current frameworks, in support of requirements from our social network partners
• Begin identifying gaps in our current controls or processes, pairing with internal stakeholders to develop remediation plans
• Assist in quarterly user access reviews, internal and external audits, and internal controls testing in support of our compliance frameworks
• Independently triage Security Assurance requests, fielding nuanced security and privacy concerns from our customers, both pre and post-sales
• Within 6 months, you’ll be making a clear impact through:
• Participate in the day-to-day management of our GRC tooling
• Become the subject matter expert with respect to the social networks’ developer portals, pairing with Engineering to enhance governance over RBAC
• Become a key stakeholder in quarterly/annual internal and external audits, including IT controls and user access reviews, all while improving/automating the evidence gathering processes
• Within 12 months, you’ll make this role your own by:
• Own our partnership compliance program and independently lead technical assessments from our social network partners, testing controls and gathering evidence
• Independently perform user access reviews and participate in internal and external audits, all while identifying and assessing gaps or issues
• Fully support our broader compliance and governance initiatives
• Assist in defining the roadmap for future work
• Surprise us! Use your unique ideas and abilities to change our GRC program in ways that we haven’t considered yet
• Of course what is outlined above is the ideal timeline, but things may shift based on business needs and other projects and tasks could be added at the discretion of your manager

• Even if your background doesn’t match the exact requirements, we encourage you to apply and share any relevant skills in a cover letter