Senior Risk and Compliance Analyst

Laserfiche is hiring for a Senior Risk and Compliance Analyst to support Laserfiche’s Governance, Risk and Compliance (GRC) programs through hands-on execution of internal audits, control assessments and continuous monitoring activities. This role works closely with internal stakeholders, external auditors, third-party assessment organizations (3PAOs) and the GovRAMP Program Management Office (PMO) to support compliance with applicable regulatory frameworks and customer requirements.

• Hybrid: Three days per week (Tuesday, Wednesday and Thursday) in-office in Long Beach, CA
• Remote work from home on Mondays and Fridays
• Periodic travel, including occasional weekend, may be required for international site audits. 

• Perform internal audits, IT general computer controls testing, application security assessments and ongoing risk assessments.
• Update risk registers and track findings, corrective action plans and remediation activities. 
• Support ongoing risk reporting and metrics tracking for internal stakeholders and executive leadership.
• Ensure evidence is accurate, current and audit-ready.
• Coordinate and manage external audits and assessments, including evidence requests, with auditors, 3PAOs, GovRAMP PMO, FedRAMP PMO and security firms. 
• Prepare and submit continuous monitoring reports and supporting artifacts to GovRAMP.
• Safeguard Laserfiche information in accordance with Laserfiche Information Security Policies.

• Perform technical validation of security controls using the AWS Management Console.
• Review and collect evidence related to AWS services, configurations and security controls, including IAM, logging, encryption and monitoring.
• Partner with ITS and Development to validate cloud control implementation and operating effectiveness.
• Support corporate and cloud security documentation and evidence mapping to NIST 800-53, ISO 27001, SOC 2, CIS controls and other applicable control frameworks and standards.
• Identify control gaps or inconsistencies and escalate findings through established GRC processes.

• Document, test and monitor IT, application and data privacy controls as part of an ongoing GRC program.
• Maintain control matrices, control narratives and framework mappings.
• Collaborate with department stakeholders and Legal to perform privacy impact assessments (PIAs) and data protection impact assessments (DPIAs).
• Support data mapping, data inventories and data privacy compliance documentation.
• Update policies, procedures and standards under the direction of GRC leadership.

• Perform vendor risk management assessments for third-party service providers. 
• Track vendor remediation activities and risk treatment plans. 
• Update business impact analyses (BIAs) and business continuity plans (BCPs). 
• Coordinate with ITS and Development on disaster recovery plan updates and testing. 

• Respond to customer security questionnaires, RFPs and security and AI due diligence requests.
• Maintain and update standard assurance artifacts such as HECVAT, CAIQ and similar documents for customer distribution.
• Partner with Sales, Legal and ITS to ensure responses are accurate, consistent and approved.
• Monitor customer contractual security and compliance requirements and flag risks or gaps.

• Bachelor’s degree in information systems, IT audit, cybersecurity or a related degree pr