{"id":2373686,"url":"https://alion.io/job/turo-senior-security-grc-analyst","title":"Senior Security GRC Analyst","company":{"id":171962,"name":"Turo","domain":"turo.com","url":"https://alion.io/company/turo-2","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":131000,"max":164000,"currency":"USD","period":"year","gross":null,"usd_annual":164000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Teams","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"Telegram","optional":false}],"status":"live","first_seen_at":"2026-10-02T00:00:00Z","employer_posted_date":"2026-10-02","last_verified_at":"2026-10-13T17:59:38Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"About the team\nTuro is searching for a highly motivated and versatile Senior Security GRC Analyst under the Enterprise Security team to lead security compliance programs as a senior individual contributor. This role carries primary ownership of SOC 2 Type II and PCI DSS audit readiness and coordination, and serves as the connective tissue between Engineering, IT, Finance, Legal, and business control owners. You will drive complex security compliance workstreams with limited oversight, exercising strong judgment and cross-functional influence to keep Turo audit-ready year-round.\nWhat you will do\nSecurity Compliance & Audit Readiness\nOwn the compliance calendar and drive end-to-end audit readiness for SOC 2 Type II and PCI DSS, including scoping, control mapping, and continuous readiness between audit cycles.\nCoordinate evidence collection across Engineering, IT, Finance, and business teams; track control owners and close gaps ahead of audit windows.\nServe as the primary day-to-day liaison with external auditors and assessors to manage requests, facilitate walkthroughs, and coordinate remediation of findings.\nMaintain and evolve the common control framework: map controls across SOC 2, PCI DSS, and other applicable standards; identify and eliminate redundant testing where possible.\nLead compliance testing activities, document results, and maintain evidence repositories that support both internal review and external audit.\nFindings, Remediation & Exception Management\nTrack open audit findings and remediation commitments; provide status reporting to Security leadership and relevant stakeholders.\nManage the security exception process and document risk acceptances, obtain appropriate approvals, and monitor exceptions through expiration or remediation.\nIdentify control gaps proactively and partner with control owners to design and implement compensating or corrective controls.\nPolicy & Governance\nDevelop, maintain, and enforce security policies, standards, and procedures; keep them current with regulatory change and evolving business needs.\nPartner with Legal on data-privacy obligations, subprocessor reviews, and breach-notification readiness.\nEstablish and report on compliance metrics - audit readiness scores, open findings aging, exception inventory, and cycle time - to drive accountability and visibility.\nIdentify and implement process and automation improvements that increase throughput and reduce manual effort across compliance workflows.\nYour Profile\n5+ years in security compliance, GRC, or IT audit, with hands-on experience running security audit programs from start to finish.\nDirect ownership of at least one full audit cycle under SOC 2 Type II and/or PCI DSS - from scoping through final report.\nDemonstrated ability to coordinate evidence collection and remediation across multiple engineering and business teams with limited oversight.\nWorking knowledge of cloud security (AWS), IAM, and encryption frameworks - sufficient to assess controls and evaluate evidence critically.\nStrong written and verbal communication skills; able to translate technical compliance requirements into clear guidance for non-security stakeholders.\nComfort operating independently in an ambiguous, fast-moving environment, managing competing deadlines without close supervision.\nBachelor's degree in Computer Science, Information Security, Information Assurance or equivalent practical experience.\nRelevant certification: CISA, CISM, CISSP, or equivalent security certification.\nExperience scaling a security compliance program through initial certification and into annual renewal cycles.\nFamiliarity with GRC tooling (e.g., Vanta, Drata, ZenGRC) and security-automation platforms.\nExperience in a regulated or high-trust industry - fintech, marketplace, or SaaS handling sensitive personal or financial data.\nFor this role, the target base salary range in San Francisco is $131,000-$164,000 annually. This role is also eligible for equity and benefits. In general, our ranges reflect the market-based target for new hire salaries based on the level and location of the role. Within the range, individual pay is determined by objective factors assessed during the application and interview process, such as job-related skills, experience, and relevant education or training. We encourage you to talk with your recruiter to learn more about the total compensation and benefits available for this role.\nTuro highly values having employees working in-office to foster a collaborative work environment and company culture. This is central to how we work, and this role will be subject to our current in-office hybrid schedule that requires Turists to work in the office three days per week on Mondays, Wednesdays, and Thursdays. We expect that employees will meet these required in-office days consistently as part of their role. Your recruiter can share more information about this requirement and the in-office perks Turo offers.\nTuro Recruiting Scam Alert:\nWe’ve learned that there are scammers targeting job candidates by impersonating Turo and its employees. We ask candidates to be careful of fraudulent job postings or suspicious recruiting activity during their job search, especially if they’re contacted through unofficial channels (such as Instagram, Telegram, MS Teams, etc.). In general, Turo interacts with candidates through our Careers page and via turo.com email addresses, and we don’t ask candidates for sensitive financial or personal info or request money as part of the hiring process (so an application fee or equipment costs). If candidates are not sure whether they’re dealing with an impersonator, they can contact Turo’s Recruiting Team at . Candidates can also report suspicious activity to the FTC or other appropriate authorities.\nTuro AI Policy:\nTuro may use AI-enabled tools to support our recruiting operations, including gathering information from candidates, drafting communications, helping with interview note-taking and assessment, and so on. These tools only supplement our team; all decisions to advance or hire candidates are made by Turo employees. While we welcome candidates to use AI-enabled tools to help prepare for their interviews, the use of such tools, including any AI chatbots or note-takers, is not permitted during live interviews or technical assessments. We want to see how you consider and solve problems in real-time, so interviews and assessments are all you (unless we indicate otherwise and ask you specifically to use an AI-enabled tool to answer a question). If during the application process you require the use of an AI-enabled tool as a reasonable accommodation for a disability, please let us know at .\nBenefits\nCompetitive salary, equity, benefits, and perks for all full-time employees\n\nEmployer-paid medical, dental, and vision insurance (Country specific)\n\nRetirement employer match\n\nLearning & Development stipend to invest in your professional development\n\nTuro host matching program\n\nTuro travel credit\n\nCell phone and internet stipend\n\nPaid time off to relax and recharge\n\nPaid holidays, volunteer time off, and parental leave\n\nFor those who are in the office full-time or hybrid we have in-office lunch, office snacks, and fun activities\n\nWe are committed to building a diverse team. If you are from a background that's underrepresented in tech, we'd love to meet you.\nAside from an award winning work environment and the opportunity to be part of the world’s largest car sharing marketplace, we are also growing the team quickly - join us! Even if you don't meet every qualification, we are looking for people with enthusiasm for what we do and we will consider you for this and other possibilities.\nAbout Turo\nTuro is the world’s largest car sharing marketplace where you can book the perfect car for wherever you’re going from a vibrant community of trusted hosts across the US, UK, Canada, Australia, and France. Whether you're flying in from afar or looking for a car down the street, searching for a rugged truck or something smooth and swanky, Turo puts you in the driver's seat of an extraordinary selection of cars shared by local hosts.\nDiscover Turo at https://turo.com, the App Store, and Google Play, and check out our blog, Field Notes.\nRead more about the Turo culture according to Turo CEO, Andre Haddad.\nTuro is an Equal Opportunity Employer and a participant in the U.S. Federal E-Verify program. Women, minorities, individuals with disabilities and protected veterans are encouraged to apply. We welcome people of different backgrounds, experiences, abilities and perspectives.\nTuro will consider qualified applicants with criminal histories in a manner consistent with the San Francisco Fair Chance Ordinance, as applicable.\nWe welcome candidates with physical, mental, and/or neurological disabilities. If you require assistance applying for an open position, or need accommodation during the recruiting process due to a disability, please submit a request to People Operations by emailing .","description_format":"text","description_chars":9067,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Parental leave","Professional development","Vision insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Internet Services","Web Security & DDoS Protection"],"lifecycle":[{"event":"open","at":"2026-10-12T18:07:47Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 27 · green card filings: 14","filings_12m":27,"filings_prev_12m":38,"green_card_filings_12m":14,"median_offered_wage_usd":194207,"route":null,"cap_exempt":false,"checked_at":"2026-10-03T21:08:04+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":74,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.818,"p_room":0.9,"age_days":11,"expected_fill_days":28,"reasons":["conf:2","win:mid"],"computed_at":"2026-10-13T05:45:00Z"},"pay":{"stated_usd_annual":164000,"is_top_pay":false},"html_url":"https://alion.io/job/turo-senior-security-grc-analyst","json_url":"https://alion.io/job/turo-senior-security-grc-analyst.json","meta":{"generated_at":"2026-10-14T01:27:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2150,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":171962},"rest":"https://alion.io/mcp/rest/get_company?id=171962"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fturo-senior-security-grc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fturo-senior-security-grc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fturo-senior-security-grc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/turo-senior-security-grc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fturo-senior-security-grc-analyst"}]}