Is the GRC Analyst role remote?

It's hybrid — Vercel expects some on-site time in Hybrid - San Francisco, New York City, London.

What's the salary range?

Vercel lists $134,000–$202,000 for this role.

How much experience is required?

At least 3 years of relevant experience for this GRC Analyst role.

Where is the role based?

Vercel is hiring for this position in Hybrid - San Francisco, New York City, London.

What's the tech stack?

Joblaze extracted these technologies from the posting: AWS, Azure, Datadog, Drata, HIPAA, ISO 27001.

What seniority level is this role?

Vercel targets mid-level candidates for this position.

Is this full-time or contract?

Full-time for this GRC Analyst role at Vercel.

GRC Analyst at Vercel

Joblaze summary

The GRC Analyst at Vercel plays a crucial role in managing compliance with various security and privacy frameworks, ensuring the company adheres to ethical and regulatory standards. This position requires expertise in audit processes within cloud environments, along with strong project management and collaboration skills to work effectively across teams. Ideal candidates will have at least three years of relevant experience and a proactive approach suited for a high-growth startup. The role emphasizes building relationships and fostering a culture of compliance throughout the organization.

Joblaze insights

Listed about 3 months ago — first seen on Joblaze July 3, 2026. Last confirmed on Vercel's careers page October 11, 2026.
Salary band is below the typical range for Security roles (median ~$170,000).
Starts above 42% of 26 comparable mid security roles in United States that list AWS we track (median $143,700 across 18 companies). See AWS salary trends
AWS appears in 20.1% of 199 comparable mid security roles in United States; Drata appears in 0.5% of 199 comparable mid security roles in United States.

Quick facts

Is the GRC Analyst role remote?: It's hybrid — Vercel expects some on-site time in Hybrid - San Francisco, New York City, London.
What's the salary range?: Vercel lists $134,000–$202,000 for this role.
How much experience is required?: At least 3 years of relevant experience for this GRC Analyst role.
Where is the role based?: Vercel is hiring for this position in Hybrid - San Francisco, New York City, London.
What's the tech stack?: Joblaze extracted these technologies from the posting: AWS, Azure, Datadog, Drata, HIPAA, ISO 27001.
What seniority level is this role?: Vercel targets mid-level candidates for this position.
Is this full-time or contract?: Full-time for this GRC Analyst role at Vercel.

From the original posting

About Vercel:

About the role:

We are looking for a Governance, Risk and Compliance (GRC) Analyst who wants to build GRC with AI, and you do not need to be an engineer to do it. We encourage and equip you to use AI tooling to build automations for audit evidence and customer security questionnaires, alongside assessing AI tools and vendors and managing audits. This is a hybrid role based in San Francisco, New York City, or London with three days a week in the office.

What you’ll do:

Assess AI tools and vendors against security, privacy, and compliance requirements, and run company compliance and ethics training
Maintain the internal controls behind ISO 27001, System and Organization Controls 2 (SOC 2), Health Insurance Portability and Accountability Act (HIPAA), and Payment Card Industry Data Security Standard (PCI DSS) compliance, and drive remediation to completion with documented progress
Use AI tooling to build automations that collect audit evidence, monitor controls, and draft security questionnaire responses, and report on controls maturity scores
Manage annual audit deliverables, write treatment plans, and track completion across teams
Answer customer compliance inquiries and maintain customer-facing security and compliance documentation

What you need:

3+ years supporting the audit lifecycle for SOC 2, ISO 27001, PCI DSS, or HIPAA in a cloud-based environment
Applied security or privacy controls to AI systems or AI vendors, such as model access, data handling, or third-party risk review
Built security policies and technical controls into the software development lifecycle (SDLC) with engineering partners
Led compliance projects across multiple business units and seniority levels

Bonus if you:

Built an automation or internal tool, with code or AI coding tools, even outside an engineering role
Worked with AI governance frameworks such as ISO/IEC 42001 or the National Institute of Standards and Technology (NIST) AI Risk Management Framework
Hold a Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), or Certified Compliance & Ethics Professional (CCEP) certification

The San Francisco, CA base pay range for this role is $134,000-$202,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process.

Disclosures:

Standard company text repeated across Vercel's postings is omitted here.