GRC Analyst

Tines is the intelligent workflow company that powers some of the world's most important workflows. 

Tines has been supporting IT and security teams from a diverse range of customers, including Canva, Reddit, SAP, Coinbase, Mars, Fin (Intercom), and McKesson.

Tines 3B, launched in 2026, is the next generation of Tines – a single, secure environment for every team’s apps, agents and automations.

As an integrator across the entire tech stack, Tines is vendor-agnostic integrating with any API-enabled service. This flexibility enables our customers to achieve their highest-priority goals faster. Tines has security woven into its DNA, and our platform is secure and private by design. 

At Tines, we're driven by our values of Simplicity, Speed, and Soundness. We're committed to delivering exceptional customer experiences while fostering a company culture that nurtures individual curiosity, growth, and integrity. We’re excited about what’s next, and we’re looking for others to join us on our journey.

Tines is seeking an experienced Senior Governance, Risk, and Compliance (GRC) Analyst to help execute and operate our compliance programs during a pivotal growth phase. Reporting to our Director of GRC, you will work across our commercial certifications — SOC 2 Type II and ISO 27001, 27701 and 42001 — and our FedRAMP program, while supporting vendor risk management and customer security assurance.

This is a hands-on execution role. You'll partner with our Staff GRC Analysts, who set certification strategy, and own the operational delivery behind it: collecting evidence, testing controls, running audit cycles, assessing vendors, and answering the security questions our customers and prospects ask. You'll also have a real mandate to automate the parts of this work that shouldn't be manual, using Tines itself.

Location: Based remotely in the United States.

What you’ll be doing:

• Certification and Audit Execution — Drive audit cycles end to end for SOC 2 Type II and ISO 27001 / 27701 / 42001: evidence collection, control testing, auditor liaison, and remediation tracking. Support gap assessments for net-new certifications we're evaluating.
• FedRAMP Program Support — Support our FedRAMP efforts, including gap analysis, remediation planning, documentation development, and coordination with 3PAO assessors.
• Continuous Control Monitoring — Operate the year-round monitoring cadence that keeps certifications live between audits — scan and pen test reporting, control drift detection, and evidence freshness.
• — Run vendor security assessments, evaluating security controls and compliance posture before acquisition, and help mature our third-party risk program.