Senior Security Assurance Analyst

What you'll do

• Lead the end-to-end ISO 27001 compliance program including certification planning, internal audits, and surveillance cycles.
• Manage a multi-program compliance portfolio including SOC 2, PCI DSS, HIPAA, NIST CSF, and various international regulations.
• Serve as the primary liaison to external auditors and certification bodies throughout the full audit lifecycle.
• Manage the Security Risk Management Framework to ensure risk identification, treatment, and reporting across the business.
• Develop, review, and maintain internal information security and data protection policies and procedures.
• Partner with Engineering to design and implement automated evidence collection and continuous control testing.
• Utilize AI tools and LLM-based workflows to automate compliance processes, policy drafting, and questionnaire responses.
• Manage customer security questionnaires and oversee the company's external trust center platform.

What we're looking for

• 5+ years of experience in security governance, risk, and compliance (GRC), IT audit, or a related security assurance role.
• 5+ years of hands-on experience with ISO 27001 and PCI DSS.
• In-depth knowledge of SOC 2, HIPAA, NIST CSF, and international frameworks like UK Cyber Essentials and NIS2.
• Experience managing, reviewing, and drafting information security policies and procedures.
• Strong technical background with the ability to communicate and negotiate effectively with engineering teams.
• Experience with GRC platforms (e.g., AuditBoard CrossComply, Vanta, or Drata), Jira, and SafeBase (preferred).
• Relevant certifications such as CISA, CISSP, CISM, CRISC, or ISO 27001 Lead Auditor/Implementer (preferred).
• Big 4 or Big 3 consulting experience (preferred).