Staff Security Analyst (Governance and Trust)

Preferred

• You have been the lead on the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination. Not a participant: you ran populations, sampling, completeness-and-accuracy, and the auditor relationship, and you have argued a control applicability or scope question with an auditor and can tell us how it ended.
• You are fluent in regulated-industry customer diligence: SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, customer audits. You understand the commercial stakes and have held the line with Sales without losing the deal.
• You have run vendor risk assessments at volume inside a third-party risk program and can tell a disposition you should make from one you should escalate.
• You think of evidence as data. You are comfortable with populations defined by query, evidence drawn from identity, HR, and cloud systems, and policies and controls managed in Git. You don't need to write code, but you need to prefer a system over a screenshot.
• You have worked inside a management system with a functioning corrective-action loop and know the difference between an action completed and a control effective.
• You have directed or mentored junior practitioners and can run a queue against metrics. You want to lead a team and can say why.
• You build cross-functional relationships deliberately and keep them. The evidence, populations, and remediation this role depends on live in other teams, and the role fails in a silo.
• You are comfortable working in an international environment: a distributed team across the US, UK, and Europe, customers and auditors across time zones, and UK and EU regimes alongside US ones.