Security and Compliance Analyst
Core
Own day-to-day operation of security, compliance, and governance programs including SOC 2, PCI DSS, NF525, GDPR, and accessibility; serve as primary point of contact for auditors and partner with Sales on customer security reviews.
Role type
Security and Compliance Analyst (GRC)
Builds
Compliance programs, audit cycles, control mappings, evidence repositories, and reusable security answer libraries.
Domain
SaaS / Experience industry (museums, tours, activities) / Security & Compliance
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
SOC 2 Type II audit cycle execution, PCI DSS requirements knowledge, GRC platform management (Drata), vendor security risk assessment, customer security questionnaire response, access controls evaluation, vulnerability management understanding, incident response basics, cloud infrastructure familiarity, risk register management, data protection program management, accessibility compliance tracking, AI/automation workflow building
Preferred skills
NF525 standards knowledge, WCAG accessibility standards, EU AI Act familiarity, ISO/IEC 42001 standards, CISA/CRISC/CIPP/E/Security+ certifications, SaaS product experience, AI agent building
Technologies
Drata, SOC 2, PCI DSS, GDPR, CCPA, CPRA, NF525, WCAG, EU AI Act, ISO/IEC 42001
Responsibilities
Lead end-to-end audit and certification cycles; maintain compliance platform and control mappings; drive remediation of control gaps with engineering and product teams; run periodic governance activities like access reviews and risk assessments; manage data protection program including DPA and impact assessments; lead responses to customer security questionnaires and RFPs; coordinate accessibility compliance; report program status and audit readiness to leadership; build AI-assisted workflows for evidence collection and reporting
Seniority
Mid-level, hands-on IC
