Governance, Risk, Compliance & Trust Analyst, Everlaw
$140-178k
+ Equity Program
Senior and Expert level
San Francisco Bay Area
Office located in Oakland, CA
Unified platform for e-discovery and litigation
Be an early applicant
Unified platform for e-discovery and litigation
501-1000 employees
B2BLegalAnalyticsSaaS
Be an early applicant
$140-178k
+ Equity Program
Senior and Expert level
San Francisco Bay Area
Office located in Oakland, CA
501-1000 employees
B2BLegalAnalyticsSaaS
Company mission
To empower organizations to better navigate litigation and investigations to chart a straighter path to the truth
Role
Who you are
- You have 5+ years of experience working as an individual contributor with a Governance, Risk, Compliance and Trust team
- You have strong working knowledge of customer trust, compliance operations, risk, and the evidence and control narratives needed to support questionnaires, reviews, and audits
- You have experience supporting FedRAMP, SOC 2, ISO 27001/27017/27018, or similar compliance frameworks
- You have led the completion of customer security questionnaires and have worked within trust portals, evidence repositories, or other GRC tooling software
- You have experience using workflow, metrics, or dashboard data to improve trust and compliance operations and to meet defined SLAs
- You can independently research moderately complex questions, synthesize inputs from multiple stakeholders, and produce high-quality written deliverables with a high bar for clarity and accuracy
- You communicate complex topics simply and concisely, tailor your communication to the audience, and navigate moderate disagreement while keeping focus on shared outcomes
- You are organized and reliable, maintain momentum across planned work and ad hoc requests, and escalate thoughtfully before risks become blockers
- You think beyond the immediate request and consider how current decisions affect future operations, compliance posture, and stakeholder experience
- You are comfortable operating in environments with some ambiguity, shifting priorities, and multiple stakeholders
- You bring sound judgment, professional maturity, and a strong sense of accountability when handling sensitive or high-visibility work
What the job involves
- As a GRCT Analyst, you will independently drive moderately complex trust, compliance, and risk workstreams that help Everlaw scale responsibly and earn customer and regulator trust over time. This role sits at the intersection of customer trust, compliance operations, audit readiness, risk management, documentation quality, and cross-functional execution
- You will help translate Everlaw’s security and compliance posture into clear, accurate, audit-ready, and customer-ready outputs. You will also help the GRCT team operate in a way that reflects Everlaw’s long-term philosophy: acting with integrity and discipline, paying attention to detail, improving process over time, setting a high bar for quality, and partnering with others in an egoless and respectful way
- This is a career-core individual contributor role for someone who can own work end to end with limited oversight, navigate ambiguity, communicate clearly with stakeholders, and improve how trust and compliance work gets done over time
- We want you to feel like part of the team early on! Our onboarding process will integrate you into the company with informative sessions on our product, policies, processes, and team structure and goals
- We’re excited for you to learn, grow, and contribute right away! We trust that you’ll bring experience and knowledge that will uplift and uplevel the team, but we don’t expect you to know everything on Day 1
- Compliance
- Support audit readiness across core frameworks such as FedRAMP, SOC 2, and ISO 27001/27017/27018 by organizing evidence, maintaining documentation quality, and partnering with control owners to close gaps
- Manage compliance operations that require structured follow-through, including evidence requests, policy and procedure updates, control narrative maintenance, and recurring review cycles
- Partner cross-functionally with Security Engineering, DevOps, IT, Legal, People, Procurement, and other stakeholders to gather inputs, validate implementation details, and produce audit-ready or stakeholder-ready outputs
- Help maintain strong execution against defined compliance SLAs, milestones, and recurring obligations, escalating risks early and driving issues through resolution
- Translate technical, operational, and regulatory topics into clear written deliverables for internal and external audiences, including concise summaries of requirements, risks, tradeoffs, and recommendations
- Support internal risk and governance processes, including security impact analyses, change-related compliance reviews, and other structured review workflows as assigned
- Contribute to the on-going operation of the Public Sector Clearance Program, to include guiding new cohorts through the program, maintaining status and tracking open issues, and communicating program updates to Everlaw stakeholders
- Customer Trust
- Manage customer security questionnaires, trust inquiries, and related diligence requests with minimal supervision, including researching answers, validating claims, gathering evidence, and producing accurate, customer-ready responses
- Maintain and improve customer-facing trust content across repositories, trust portals, knowledge resources, and standard response libraries so that recurring requests can be answered more consistently and efficiently
- Partner closely with Security Engineering, DevOps, Legal, GTM, Product, IT, and other stakeholders to collect inputs, resolve ambiguities, and ensure trust responses reflect current implementation and approved positioning
- Help maintain strong execution against trust-related SLAs and operating expectations, including turnaround time, response quality, and internal coordination on high-priority or high-visibility requests
- Identify gaps, inconsistencies, or stale content in trust materials and proactively drive updates so that customer-facing representations remain accurate, supportable, and easy to reuse
- Support broader trust enablement initiatives, including trust center improvements, evidence library maintenance, standardization of response content, and process improvements that reduce manual effort and rework
- Use workflow data and request trends to identify recurring customer concerns, bottlenecks, and improvement opportunities, then recommend practical changes to content, process, or tooling
- Manage customer security questionnaire and trust inquiry workflows with minimal supervision, including researching answers, synthesizing evidence, improving repository content, and helping stakeholders receive timely and accurate responses
- Vendor Reviews
- Own end-to-end delivery of moderately complex vendor review workstreams, including intake review, scoping, dependency management, stakeholder coordination, and timely completion with limited oversight
- Conduct security and compliance reviews of third parties by gathering and analyzing documentation such as security questionnaires, architecture details, data flow information, attestations, policies, and contractual commitments
- Evaluate vendor security posture against Everlaw requirements for confidentiality, integrity, availability, privacy, access control, incident response, change management, and regulatory obligations
- Partner with Procurement, Legal, Security Engineering, IT, business owners, and other stakeholders to validate proposed use cases, clarify data access patterns, and ensure risks are understood before onboarding or renewal decisions are made
- Help determine whether vendor controls, architecture, access models, and contractual terms are appropriate for the intended use case, and clearly document identified gaps, assumptions, compensating controls, and recommended next steps
- Maintain strong execution against vendor review SLAs, queue expectations, and recurring review obligations, escalating blockers and higher-risk issues early
- Security Training
- Own end-to-end delivery of moderately complex security training program workstreams, including planning, content coordination, stakeholder alignment, rollout tracking, and continuous improvement with limited oversight
- Support the design, maintenance, and execution of security and compliance training required for Everlaw personnel, with particular attention to role-based, environment-specific, and regulatory training obligations
- Maintain training content so it is accurate, current, and aligned with Everlaw policies, operational practices, and external requirements such as FedRAMP, CJIS, export control, and related obligations where applicable
- Partner with GRCT, Legal, HR, Security, IT, and business stakeholders to gather subject matter input, validate training expectations, and ensure training materials reflect approved guidance and current operating reality
- Coordinate recurring training cycles, onboarding-related assignments, acknowledgements, re-certifications, and related evidence collection so completion records are reliable, reviewable, and audit-ready
- Help maintain strong execution against program deadlines, annual and periodic training obligations, and related audit or assessment requests by tracking status, identifying gaps early, and driving follow-through
- Contribute to a training program that reinforces Everlaw principles by promoting disciplined execution, clear communication, respect for users, and a high bar for secure handling of sensitive data
Our take
Everlaw builds technology to help corporations, law firms and government entities solve the toughest problems in the legal industry. The company's platform includes features to help speed up legal work, freeing up time to be spent on more value-add activities. Everlaw’s clients include most of the top 10 class action firms in the US and it is also used by state attorney generals in every state in the US.
Law is a big industry where a lot of money is spent, but it has been largely untouched by technology until recently, leaving a big opportunity. Testament to this, the company was able to expand to Australia and New Zealand following a partnership with Australian e-discovery provider Adio. It continues to deliver new features such as "AI Deep Dive" which lets legal teams uncover and verify key evidence from documents.
The company is also pursuing growth for its Everlaw for Good Program, seen at the 2024 Equal Justice Conference in Detroit. That year, it appointed its first program director as it works to dismantle barriers to justice for low-income Americans and marginalised communities in need of legal representation. It now has over 225 participating organizations.
Steph
Company Specialist at Welcome to the Jungle
Insights
Top investors
Company
Funding (last 2 of 6 rounds)
Nov 2021
$202m
SERIES D
Mar 2020
$62m
SERIES C
Total funding: $298.6m
Company benefits
- Mind & Body - Everlaw cares about the whole person, and that is underscored by our health care plan. Everlaw offers employees and their dependents private health insurance which covers 100% of employee health insurance premiums and 60% of dependent premiums.
- Investing in Your Future - Everlaw believes in building for the long-term – for both our product and our employees. Everlaw enrolls employees in a pension fund upon hire where employees contribute 4% of their salary with a company match of 4%. An additional 1% comes from the UK government in the form of tax relief.
- Family Bonding - Everlaw supports growing families by ensuring employees receive 100% of their salary for up to 10 weeks for family-bonding leave, in addition to 8 weeks of fully paid leave for birthing parents.
- Everlawlidays and More - When you have a group of highly skilled, highly driven truth-finders, it’s important to build in breaks for recharging. Everlaw offers employees 20 days of paid holiday per calendar year in addition to the eight public holidays in England and Wales. Everlaw also recognises four ‘Everlawlidays’ that are designated days off for the whole company. Upon their fourth work anniversary, employees are upgraded to 23 days of holiday and to 27 days on their seventh work anniversary.
- On-Site Lunches and Snacks - Enjoy delicious daily catered lunches and sample the rotating snack and beverage selections in our London office.
- Never Stop Learning - We are committed to Everlawyers’ professional growth and encourage employees to pursue the right learning and development opportunities for wherever they are in their journey. With an annual Learning & Development stipend of £1,600, Everlawyers can attend conferences, obtain certifications, join classes and meet with career coaches.
- Giving Back - We are committed to supporting our local communities so we build in time for you to give back. In addition to time off for company-sponsored volunteer events, employees get four paid hours per quarter to volunteer at any charity recognised by the HMRC.
- Creating Community - Everlaw is filled with empowered, passionate problem solvers who like to have fun. From team dinners to holiday parties, Everlaw hosts optional company-wide bonding events regularly. Additionally, each department is given a monthly budget for activities and events planned by you and your colleagues. Events have included go-karting, escape rooms, trapeze classes and intramural sports.
Company HQ
Downtown, Oakland, CA
Leadership
AJ Shankar
(CEO & Founder)Previously a Senior Software Engineer at TheFind (acquired by Facebook).
Salary benchmarks
We don't have enough data yet to provide salary benchmarks for this role.
Submit your salary to help other candidates with crowdsourced salary estimates.
Share this job
View 30 more jobs at Everlaw