GRC analyst with 5 years of experience running compliance programs for SaaS companies selling to enterprise and healthcare buyers. Led SOC 2 Type II and ISO 27001 audits to clean opinions while cutting evidence collection effort in half. Brings control mapping, risk registers, vendor reviews and fast security questionnaire turnaround.
Experience
GRC Analyst, Clearpoint Scheduling (Denver, CO)
Feb 2023 – Present
Coordinated SOC 2 Type II and ISO 27001 surveillance audits with zero exceptions across 115 controls
Automated evidence collection in Vanta for 70% of controls, halving audit preparation hours
Maintained the risk register with 48 risks, presenting quarterly treatment status to the security steering committee
Answered 160 customer security questionnaires a year with a 3-day median turnaround, supporting $9M in new ARR
Compliance Analyst, Front Range Medical Billing (Aurora, CO)
Jun 2021 – Jan 2023
Conducted annual HIPAA security risk assessment and tracked 35 remediation actions to closure
Reviewed 60 vendors for security posture and executed BAAs before data sharing
Education
B.S.B.A. Business Information and Analytics, University of Denver (Sep 2017 – Jun 2021)
Skills
Frameworks: SOC 2, ISO 27001, HIPAA, NIST CSF, CIS Controls
Tools: Vanta, Drata, OneTrust, Jira, Confluence
Risk: Risk registers, vendor risk management, policy writing, control testing
How to write a GRC Analyst resume
A strong GRC Analyst resume shows the systems you built, the scale they run at, and the measurable effect on speed, reliability or cost. Put your most relevant recent role first and make every bullet show a result, not a duty.
Sections, in order
Summary
Experience
Projects
Skills
Education
Length: One page for most candidates; move to two only if every line is relevant.
Summary: Write two or three lines: your role, your strongest skills, and one result that proves them.
Skills to feature
Programming languages
System design
Cloud platforms (AWS, GCP, Azure)
CI/CD
Testing and code review
Databases and SQL
Observability
Security fundamentals
APIs and integrations
Technical documentation
Example bullet points
Rebuilt the checkout service in Go, cutting p95 latency from 900 ms to 180 ms for 2M monthly users
Introduced contract tests and staged rollouts, reducing production incidents by 45% in two quarters
Migrated 30 services to Kubernetes with Terraform, lowering cloud spend by $250k a year
Tips from recruiters
Group skills by category (for example "Languages: Go, TypeScript") so recruiters and ATS parsers find them quickly.
Link to a repository, demo or write-up for at least one project you can talk about in depth.
Name the stack inside each bullet; keyword matching happens at the bullet level, not only in the skills list.
Recommended templates
Classic (ATS-friendly): Jake's-style LaTeX classic: small caps and hairline rules
Tech (ATS-friendly): Developer style: mono headings and tags, sans body
Modern (ATS-friendly): Clean single column with accent headings and rules
GRC Analyst resume FAQ
What should a GRC Analyst resume include?
A GRC Analyst resume should show the systems you built, the scale they run at, and the measurable effect on speed, reliability or cost. Use these sections in this order: Summary, Experience, Projects, Skills and Education. Put your most relevant recent role first and make every bullet show a result, not a duty.
What is the best resume template for a GRC Analyst?
Classic, Tech and Modern work well for GRC Analyst roles. They are single-column with standard headings, so applicant tracking systems (ATS) parse them reliably.
How long should a GRC Analyst resume be?
One page for most candidates; move to two only if every line is relevant.
Which skills should a GRC Analyst put on a resume?
Prioritize the skills named in the job posting. Common ones for GRC Analyst roles are Programming languages, System design, Cloud platforms (AWS, GCP, Azure), CI/CD, Testing and code review and Databases and SQL.
How do I write strong GRC Analyst resume bullet points?
Start with an action verb, say what you did, and end with a measurable result such as latency, uptime and deploy frequency. For example: "Rebuilt the checkout service in Go, cutting p95 latency from 900 ms to 180 ms for 2M monthly users."