GRC Analyst

In 2001, a prominent corporate fraud scandal led to the Sarbanes-Oxley Act (SOX) of 2002, which introduced strict regulations on financial reporting and internal controls. While SOX was primarily focused on corporate governance, it became a foundational moment for IT controls and compliance—forcing companies to establish stronger audit trails, risk management processes, and accountability in IT systems.

2017, In one of the most infamous data breaches in history, the personal information of 147 million people was exposed due to an unpatched vulnerability. The breach wasn’t just a technical failure—it was a breakdown in governance and risk management. A known vulnerability had been disclosed, but it wasn’t properly tracked or remediated, showing a lack of strong risk and compliance processes.

2021, a single compromised password led to a ransomware attack that shut down fuel supplies across the U.S. East Coast, causing widespread panic and economic impact. Investigations found poor governance over identity management and a lack of segmented networks, making it easier for attackers to escalate their access.

Each of these cases demonstrates why GRC is the backbone of security. GRC professionals don’t just enforce rules—they prevent breaches, protect data, and enable business continuity. Whether it’s through risk assessments, compliance frameworks, vendor oversight, or incident response planning, a strong GRC function ensures security isn’t just a technical concern but an integrated business priority.

Risk management isn’t just about IT or security — it’s about business resilience. Strong governance over identity access, network segmentation, and incident response can prevent catastrophic failures.

Mercury is growing rapidly, and as we expand beyond, we must continue to build resilience and improve governance. We have a solid foundation but the expansion, renovation, and exploration that come next needs guardrails all along the way. We are looking for a GRC analyst to help build the battens and transoms that will lift up our business continuity and resilience. 

As part of this role, you and your team will:

• Collaborate with the engineering team to define and enhance the organization's security posture.

• Apply a deep understanding of Governance, Risk, and Compliance (GRC) principles to engineering initiatives.

• Work closely with engineering to improve the reliability and security of the business.

• Implement, monitor, and maintain various security frameworks, with a focus on regulatory compliance standards (e.g., NIST, PCI, CIS).

• Automate security controls to minimize risks and enhance overall security resilience.

The ideal candidate for the role:

• Familiarity with standard security frameworks, including NIST, PCI-DSS, CIS, ISO, etc.

• Strong problem-solving and analytical skills, with the ability to remain composed in high-stress situations.

• Fundamental understanding of accepted security practices, including troubleshooting, identifying attack vectors, and providing customer support.

• Knowledge and understanding of cloud services, with a 100% cloud-native approach.

Your Day to Day:

In this role, you will be a tech-savvy professional who excels in communicating governance, risk, and compliance requirements for various technologies. Your immediate responsibilities will include conducting a gap analysis on various frameworks. You will create a comprehensive plan to address and close these gaps, engaging relevant stakeholders throughout the process.

Tools and Technologies:

• Utilize a range of tools and technologies, including but not limited to:

  • AWS Config, Audit Manager

  • Orca,

  • GitHub

  • Vanta

• GRC (Governance, Risk, and Compliance) tools

*Mercury is a financial technology company, not a bank. Banking services provided through Choice Financial Group, Column N.A., and Evolve Bank & Trust; Members FDIC.

The total rewards package at Mercury includes base salary, equity (stock options), and benefits. Our salary and equity ranges are highly competitive within the SaaS and fintech industry and are updated regularly using the most reliable compensation survey data for our industry. New hire offers are made based on a candidate’s experience, expertise, geographic location, and internal pay equity relative to peers.

Our target new hire base salary ranges for this role are the following:

• US employees in New York City, Los Angeles, Seattle, or the San Francisco Bay Area: $151,000-$188,700

• US employees outside of the New York City, Los Angeles, Seattle, or the San Francisco Bay Area: $135,800-$169,800

• Canadian employees (any location): CAD 142,600-160,500

Mercury values diversity & belonging and is proud to be an Equal Employment Opportunity employer. All individuals seeking employment at Mercury are considered without regard to race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, sexual orientation, or any other legally protected characteristic. We are committed to providing reasonable accommodations throughout the recruitment process for applicants with disabilities or special needs. If you need assistance, or an accommodation, please let your recruiter know once you are contacted about a role.

We use Covey as part of our hiring and / or promotional process for jobs in NYC and certain features may qualify it as an AEDT. As part of the evaluation process we provide Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound on January 22, 2024. Please see the independent bias audit report covering our use of Covey here.

#LI-AC1