GRC Analyst

Who we are The real world is the next frontier, and at Metropolis, we are creating the artificial intelligence to make it responsive. We are pioneering the Recognition Economy — a future where mundane repetition disappears and being known unlocks access, comfort and belonging everywhere you go. From transforming parking into a seamless drive-in, drive-out experience for millions of Members to expanding our intelligence layer across retail and hospitality, we are building a world that feels instinctive and magical. The future isn’t coming; it’s here, and we need builders, innovators and problem solvers to help us create it. Who you are Metropolis is seeking a Governance, Risk, and Compliance (GRC) Analyst to join our expanding Security team. Reporting to the Senior Manager, GRC, you will mature information security policies, drive employee security awareness, and pioneer our AI governance framework. You will partner across Technology, Legal, Internal Audit, Procurement, and People Operations to safeguard customer trust and support operational excellence. What you'll do Author, update, and enforce corporate security policies to guarantee cross-departmental compliance Deploy and manage required information security training campaigns as the platform owner Transform static policies into interactive modules with comprehension quizzes for mandatory sign-offs Establish and enforce an internal AI governance framework with Data, Legal, and Tech teams Conduct structured risk assessments on emerging tools and internal AI models to maintain behavioral guardrails Report training metrics, policy exceptions, and risk postures directly to senior management Review vendor security profiles and software pipelines to mitigate security risk What we're looking for 3+ years of experience in information security GRC, cybersecurity training, or technology compliance Proven track record of managing required security awareness programs and driving cross-functional accountability Experience with modern training orchestration platforms and understanding of AI and machine learning data security Working knowledge of standard industry frameworks, specifically SOC 2 and PCI-DSS Communication sk ills with the ability to explain complex regulatory needs to non-technical employees Bachelor’s degree in Cybersecurity, Information Systems, or an equivalent technical discipline While not required, these are a plus: GRC certifications such as CISA or CRISC 4 Days in Office: Metropolis values in-person collaboration to drive innovation, strengthen culture, and enhance the Member experience.