--- title: 'GRC Analyst - Public Sector at Socure' canonical: 'https://feeny.ai/job/grc-analyst-public-sector-socure-hub-washington-dc-jrv0rwwwr6t0' type: 'job' last_seen: '2026-09-17' --- # GRC Analyst - Public Sector at Socure - **Company:** [Socure](https://feeny.ai/companies/socure) - **Location:** Hub / Washington, DC - **Compensation:** $120k–$145k - **Employment:** full-time - **Work type:** hybrid - **Posted:** 2026-09-11 - **Last confirmed live:** 2026-09-17 - **Apply:** https://jobs.ashbyhq.com/socure/ac623889-7cbb-4951-aa04-3a0f74178dda ## Job description Why Socure? Socure is building the identity trust infrastructure for the digital economy — verifying 100% of good identities in real time and stopping fraud before it starts. The mission is big, the problems are complex, and the impact is felt by businesses, governments, and millions of people every day. We hire people who want that level of responsibility. People who move fast, think critically, act like owners, and care deeply about solving customer problems with precision. If you want predictability or narrow scope, this won’t be your place. If you want to help build the future of identity with a team that holds a high bar for itself — keep reading. ## Overview Socure is seeking an Analyst, GRC – Public Sector to own the hands-on execution of the company’s governance, risk, and compliance operations for its public sector business. Reporting to the Director of GRC – Public Sector, this role is responsible day-to-day for running FedRAMP/GovRAMP continuous monitoring, building and maintaining the POA&M and compliance trackers that keep the program audit-ready, and coordinating access reviews, vulnerability remediation, and evidence collection with Security, Engineering, IT, DevOps, Product, Legal, and other teams. As the Analyst builds fluency in these operational fundamentals, the role grows to include drafting customer-facing compliance and RFP response content that makes Socure’s security posture compelling to public sector buyers, and pursuing automation-first, system-driven improvements, including machine-readable formats like OSCAL and AI-enabled workflows, that reduce manual effort and challenge how the team has traditionally done this work. ## Role and Responsibilities Compliance & Certification Management - Day-to-day coordination and execution of externalThird Party Assessment Organization (3PAO) assessments and responding to auditor requests for evidence and documentation. - Maintain and update FedRAMP and GovRAMP controls and documentation in alignment with organizational and regulatory requirements, including controls aligned with NIST SP 800-53 rev 5 and other related frameworks. - Prepare certification and authorization packages and maintain related documentation such as the System Security Plan (SSP) and associated appendices. - Replace manual evidence collection with system-generated, API-driven, or continuously validated evidence where possible. Build and maintain the trackers, procedures, and status-reporting artifacts that operationalize this work, structured so other stakeholders can use them directly. Continuous Monitoring & Vulnerability Management - Design and evolve an automation-first continuous monitoring program leveraging system integrations, telemetry, and real-time data pipelines - Lead the day-to-day FedRAMP continuous monitoring process including vulnerability management lifecycle, from identification through remediation and verification, coordinating with Security, Engineering, and DevOps teams to address issues identified with tools such as Wiz, Burp Suite, AWS native services, and other platforms and resolve issues within FedRAMP and GovRAMP timelines. - Coordinate recurring continuous monitoring compliance activities such as access reviews, incident response exercises, and contingency plan testing. Access Management & Training - Design scalable and automated access validation mechanisms integrated with identity and infrastructure systems - Design, implement and deliver FedRAMP training programs to promote compliance awareness - Create and manage automated workflows to improve efficiency. Audit & Assessment Readiness - Transform compliance evidence from static repositories into dynamic, system-driven evidence models supporting real-time audit readiness - Conduct internal reviews of logged events and control activities, escalating issues or gaps to the Director of GRC and provide status updates and reports highlighting trends, risks, and remediation progress. Process Improvement & Collaboration - Collaborate with the Director of GRC to design automation-first and AI-enabled workflows that reduce manual effort and enable scalable compliance operations - Support the development, rollout, and maintenance of machine-readable compliance documentation (e.g., OSCAL or comparable structured formats) to facilitate interoperability - Partner with automation and engineering teams to integrate structured compliance data into Socure’s broader risk management and monitoring ecosystem including vulnerability remediation, access requests, and compliance reporting. - Monitor regulatory and industry trends for potential impacts to compliance strategy. Public Sector Sales & Customer Engagement - Serve as a security subject matter expert for public sector sales activities, translating compliance controls and system capabilities into clear, accurate, and compelling customer-facing narratives. The Analyst is expected to learn the difference between writing that confirms Socure meets a requirement and writing that persuades a public sector buyer that Socure’s approach is comfortable and superior to competitors’, with the Director retaining final review and approval given the contractual and sales stakes. - Support development of external communications such as press releases and customer-facing materials related to security certifications and authorizations. - Build and maintain scalable response frameworks (e.g., answer libraries, structured content, or AI-assisted tools) to provide consistency, accuracy, and speed across RFP and RFx responses Monitor Evolving Requirements - Monitor new and evolving requirements and perform gap analyses including - Updates to applicable NIST Special Publications and other government standards - Contract security requirements from new customers - Updates to the FedRAMP Program requirements and processes as the program evolves - Provide input to standards bodies on evolving standards when applicable Required Qualifications - 4+ years of hands-on cybersecurity, compliance, or identity-management experience, including demonstrated personal execution of FedRAMP, GovRAMP, or comparable continuous-monitoring work — running scans, building or maintaining a POA&M, and preparing deviation requests. Public sector experience is a plus but not required. - Direct experience with FedRAMP, GovRAMP, and NIST frameworks (800-53, 800-63, 800-171). - Proven ability to personally execute continuous monitoring, vulnerability remediation, and compliance reporting. - Proven ability to design and improve repeatable compliance processes - identifying inefficiencies, defining clear steps, and building structure where none exists; experience using AI tools (e.g., ChatGPT, Glean, Gemini) and machine-readable formats (e.g., OSCAL) to accelerate that work is a strong plus. - Strong communication, organization, and collaboration skills with the ability to manage multiple priorities, including strong written communication and the ability to write persuasively for a customer audience — distinct from writing that is merely compliance-accurate. - Ability to adapt to changing requirements - Demonstrated customer-facing experience and enough exposure to product or sales positioning to distinguish compliance-accurate writing from writing that persuades a buyer; prior RFP-specific experience is not required. - Must be a U.S. Person (U.S. Citizens or U.S. Permanent Residents) residing in the United States and be able to obtain a U.S. OPM NACI clearance. ## Preferred Qualifications - Experience in regulated industries (e.g., financial services, healthcare) and knowledge of privacy and compliance frameworks such as GDPR, CCPA, and key NIST standards. - Professional certifications preferred (CISSP, CISM, CISA, IAPP). - Proven hands-on contribution to certification and compliance initiatives (FedRAMP, GovRAMP, NIST 800-63/171). - Skilled in continuous monitoring, vulnerability management, policy updates, and audit coordination across cross-functional teams. Also valued: a demonstrated track record of identifying and closing process gaps proactively, without waiting for direction. - Strong understanding of evolving cybersecurity standards and digital identity regulations, with the ability to translate them into practical risk and compliance improvements. Socure is an equal opportunity employer that values diversity in all its forms within our company. We do not discriminate based on race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. If you need an accommodation during any stage of the application or hiring process—including interview or onboarding support—please reach out to your Socure recruiting partner directly. Follow Us! [YouTube](https://www.youtube.com/c/Socure) | [LinkedIn](https://www.linkedin.com/company/socure/) | https://x.com/socureme | [Facebook](https://www.facebook.com/socure/) ## About Socure ## Company Overview - **One-liner**: Socure provides an AI-powered platform for digital identity verification, fraud prevention, and risk decisioning, used by enterprises and government agencies to verify consumers, businesses, and employees. - **Entity Type**: Private (Series E) - **Headquarters**: Incline Village, Nevada, USA - **Founded**: 2012 - **Founders**: Johnny Ayers (CEO) ## Core Business - **Primary industry/industries**: Digital Identity Verification, Fraud Prevention, Risk Decisioning, RegTech - **Target customers**: B2B — primarily Enterprise and Government. Serves financial services (18 of top 20 banks), government agencies (13 U.S. states, 2 federal agencies), gaming/sportsbooks, healthcare, telecom, e-commerce, marketplaces, and fintechs. - **Mission or purpose**: To verify 100% of good identities and eliminate identity fraud. ## Products & Services - **RiskOS®**: The company’s core AI platform for identity and risk decisioning. It is a fully vertically integrated platform that allows customers to design, test, and deploy identity, risk, compliance, age assurance, and authentication workflows across the entire customer journey. - **Predictive Risk Score Solution**: A risk scoring solution that provides real-time fraud protection and decisioning. - **Effectiv (Acquired)**: An end-to-end identity fraud and payment risk management solution that adds transaction monitoring, credit underwriting, and Know-Your-Business (KYB) capabilities to the Socure platform. - **FedRAMP Authorized Solution**: A version of the platform authorized for use by U.S. federal government agencies. ## Market Standing - **Valuation/Market Cap**: Not publicly available (Private company). - **Key Metric**: Serves over 3,000 customers. The company has access to an identity graph of hundreds of billions of records and over 40 billion historical known outcomes. - **Notable Investors/Partners**: Investors are not explicitly listed on the provided sources, but the customer base includes Capital One, Citi, Chime, SoFi, Lili, Green Dot, Robinhood, Dave, Gusto, Poshmark, Uber, DraftKings, PrizePicks, and the State of California. - **Growth Signals**: - Achieved **FedRAMP Authorization** in April 2025, a significant milestone for selling to U.S. federal government agencies. - Acquired **Effectiv** to expand into payment risk management and credit underwriting. - Customer base includes 18 of the top 20 banks and 500+ fintechs. - Over 130 public sector organizations as customers. - Listed 100 open positions across the company. ## Competitive Advantages - **Vertically Integrated Platform**: Socure claims to be the industry’s only fully vertically integrated identity and risk platform, which it says delivers unparalleled auto-approval and fraud capture rates. - **Massive Data Graph**: Its identity graph of hundreds of billions of records and 40 billion historical outcomes provides a deep data moat that is difficult for competitors to replicate. - **Breadth of Use Cases**: The platform supports virtually any industry and use case, from workforce verification to prediction markets, making it a versatile partner. - **Government Authorization**: FedRAMP authorization gives it a unique and defensible position in the public sector market. ## Strategic Focus - **Government Expansion**: With the recent FedRAMP authorization, a major focus is expanding into federal and state government programs. - **Platform Expansion**: Integrating the Effectiv acquisition to offer a more comprehensive suite covering identity, payments, and credit risk. - **AI Innovation**: Continuing to leverage AI on "offense" to keep pace with the fast-moving AI threat landscape (deepfakes, synthetic identity fraud). ## Why Work Here - **Remote-First Culture**: Socure is a remote-first company with talent hubs in San Francisco, Seattle, New York, Washington DC, Miami, London, Chennai, Bangalore, and Hyderabad. Employees have flexibility and autonomy. - **High-Impact Work**: The company tackles hard problems in digital identity and fraud, which are central to trust in the digital world. The culture emphasizes high performance and purpose. - **Benefits**: - Market-competitive base salary and performance bonuses. - Equity for all full-time employees. - Comprehensive medical, dental, and vision insurance. - Mental health support. - 401(k) with company match. - Flexible PTO and generous paid parental leave. - Professional development stipend. - Work-from-home stipend and Deskpass access for coworking. - Hackathons to fuel innovation. - **Growth & Development**: Internal mobility and career pathing opportunities, access to the latest technology. - **Team Size**: Approximately 386 total employees (per Built In), with 100 open positions signaling strong growth. ## Sources 1. [socure.com](https://www.socure.com/) 2. [socure.com](https://www.socure.com/company/careers) 3. [socure.com](https://www.socure.com/company) 4. [jobs.ashbyhq.com](https://jobs.ashbyhq.com/socure?source_page=%2Fcompany%2Fcareers) 5. [builtin.com](https://builtin.com/company/socure) ## Other roles at Socure - [Compliance Operations Manager](https://feeny.ai/job/compliance-operations-manager-socure-san-francisco-7ydyfcfd7333) — San Francisco, CA - [Data Scientist II, Client Analysis](https://feeny.ai/job/data-scientist-ii-client-analysis-socure-new-york-dx8txgxwdce3) — New York, NY - [Account Executive Director, Finserv](https://feeny.ai/job/account-executive-director-finserv-socure-united-states-3j5m3ndvt97y) — United States - [Head of Solution Consulting, Channel](https://feeny.ai/job/head-of-solution-consulting-channel-socure-new-york-pyrzm22c9mjg) — New York, NY - [Staff Data Scientist - Fraud & Risk](https://feeny.ai/job/staff-data-scientist-fraud-risk-socure-new-york-02w7yyf21e3q) — New York, NY - [Senior Product Manager, Watchlist](https://feeny.ai/job/senior-product-manager-watchlist-socure-san-francisco-knf67bk9sxef) — San Francisco, CA - [Associate Procurement Analyst](https://feeny.ai/job/associate-procurement-analyst-socure-san-francisco-gn9nh2sfhz91) — San Francisco, CA - [Software Engineer-II Backend](https://feeny.ai/job/software-engineer-ii-backend-socure-london-cc7exkedd0mb) — London, United Kingdom - [AI Enablement Engineer](https://feeny.ai/job/ai-enablement-engineer-socure-new-york-3mnra2hkm0ag) — New York, NY - [Software Engineer-II SRE](https://feeny.ai/job/software-engineer-ii-sre-socure-bangalore-z433swgb8dh9) — Bangalore, India