Associate GRC Analyst

KAYAK part of Booking Holdings (NASDAQ: BKNG) is a leading travel search engine. With billions of queries across our platforms we help people find their perfect flight stay rental car and vacation package. Were also transforming business travel with a new corporate travel solution KAYAK for Business.

As an employee of KAYAK you will be part of a travel company that operates a portfolio of global metasearch brands including momondo Cheapflights and HotelsCombined among others. From start-up to industry leader innovation is in our DNA and every employee has an opportunity to make their mark. Our focus is on building the best travel search engine to make it easier for everyone to experience the world.

KAYAK is looking for a motivated Associate GRC Analyst to join our Cyber Governance Risk and Compliance team! This is an exciting opportunity for an early-career professional to grow within a dynamic cybersecurity and risk management environment. A great candidate has a solid foundational understanding of GRC concepts some hands-on exposure through internships or academic projects and a curiosity for modern approaches (such as GRC Engineering) where automation code and data-driven workflows are transforming traditional GRC practices.

You will work alongside an experienced team to support risk assessments compliance activities policy management control monitoring and business continuity and disaster recovery (BC/DR) effortswhile contributing to the modernization of our GRC program.

Note this position is required to work from our Cambridge or Concord MA office 3 days per week.

In this role you will:

• Support the execution of risk assessments including identifying documenting and tracking risks across business and technology areas

• Help maintain and update policies standards and procedures aligned with security and compliance frameworks such as NIST CSF SOC 2 PCI DSS and GDPR

• Help coordinate internal and external audits by gathering evidence tracking findings and following up on remediation steps

• Contribute to control testing and monitoring verifying that implemented controls are working as intended

• Maintain the risk register and support risk treatment tracking

• Assist with customer-facing security reviews including completing security questionnaires and preparing due diligence documentation

• Support the development maintenance and testing of Business Continuity and Disaster Recovery plans including Business Impact Analyses (BIAs) and recovery strategies

• Collaborate with engineering security and business teams to gather evidence clarify requirements and communicate compliance obligations

• Contribute to efforts to automate and streamline GRC processes for example helping to reduce manual evidence collection through scripts APIs or compliance platform integrations

• Stay current on regulatory changes emerging frameworks and evolving approaches to governance and compliance

Please apply if you have:

• A bachelors degree in a relevant field (such as cybersecurity information systems computer science risk management or business) or equivalent practical experience training or transferable skills

• A foundational understanding of GRC concepts including risk management controls compliance frameworks and audit processes

• Basic familiarity with Business Continuity and Disaster Recovery principles including concepts like Business Impact Analyses recovery time objectives and recovery point objectives

• Some familiarity with at least one major security or compliance framework (such as NIST CSF SOC 2 or PCI DSS)

• Experience in a GRC cybersecurity internal audit IT risk or business continuity context paid academic capstone or volunteer experience is all considered

• Clear written and verbal communication skills including the ability to explain risk and compliance concepts to a range of audiences

• Strong organizational skills and the ability to manage multiple priorities at once

• A curious analytical mindset and a genuine interest in learning and asking questions

It would be a plus if you also have:

• Exposure to or interest in treating GRC processes as code for example automating controls using APIs or applying engineering approaches to scale compliance work (no prior coding experience required; well support your learning)

• Prior experience with a compliance or business continuity platform such as Drata or RiskConnect

Benefits and Perks

• Work from (almost) anywhere for up to 20 days per year

• Focus on mental health and well-being:

  • Company-paid therapy sessions through SpringHealth

  • Company-paid subscription to HeadSpace

  • Company-wide week off a year the whole team fully recharges (and returns without a pile-up of work!)

  • No meeting Fridays

• Paid parental leave

• Generous paid vacation time off for your birthday

• Paid volunteer time

• Focus on your career growth:

  • Development Dollars

  • Leadership development

  • Access to thousands of on-demand e-learnings

• Travel Discounts

• Employee Resource Groups

• Competitive retirement and health plans

• Free lunch 2 days per week

• Fun quarterly events such as boat trips arcades ski trips Thursday happy hours and more

There are a variety of factors that go into determining a salary range including but not limited to external market benchmark data geographic location and years of experience sought/required. The range for this Massachusetts based role is $85000 - 95000.00 not inclusive of annual bonus.

We offer a competitive base salary and benefits including: health benefits; flexible spending account; retirement benefits; life insurance; paid time off (including PTO paid sick leave medical leave bereavement leave floating holidays and paid holidays); and parental leave benefits.

Inclusion

At KAYAK we want everyone to have the space to grow share ideas and do great work. Thats why were focused on hiring the best talent from all walks of life and experiences supporting them well and making sure no one feels like they have to fit a mold to belong here.

Need any adjustments for the interview application or on the job No problem - just give us a heads-up. Weve got you.

#LI-EI1

Required Experience:

IC