Compliance Trust Analyst

Join Abnormal AI, a leading cybersecurity SaaS provider, as a Trust Analyst II. In this role, you will be part of the Compliance Trust team, responsible for driving internal and external audit readiness, managing enterprise and third-party risk, and leading governance across information security, AI, and data. You will own Abnormal's governance and policy program, manage risk management operations, and provide general compliance support. The ideal candidate will have a strong background in cybersecurity, technology risk, and GRC, with experience in ISO 27001 implementation and maintenance.

Responsibilities

• Assumer la responsabilité de la gestion des programmes de gouvernance et de politique de l'entreprise, y compris la rédaction, la révision et la maintenance des politiques.
• Diriger et animer les comités de gouvernance de l'entreprise, y compris la définition des ordres du jour, la facilitation des parties prenantes et la prise de décisions.
• Gérer les opérations de gestion des risques, y compris le registre des risques, les évaluations des risques et l'administration des exceptions aux risques.
• The ideal candidate will have the mindset of an auditor with keen attention to detail, possess exceptional skills in project management, be a good communicator who excels at explaining complex technology to diverse audiences in a way that fosters understanding and ownership, has strong collaboration and business sense, and an adept awareness of our customers' requirements of Abnormal as a leading cybersecurity SaaS provider
• Owns outcomes rather than activity — accountable for a compliance domain end to end, including audit outcomes and remediation tracking
• Acts as a trusted partner to other Abnormal teams and external auditors on their domain, leading structured discussions grounded in evidence rather than assumption, and represents the function credibly in auditor-facing settings
• Comfortable owning and running cross-functional governance committees (e.g., AI Governance, Data Governance, Security Governance), setting agendas, driving decisions, and following through on action items without needing to be chased

Requirements

• Self-motivated and able to work efficiently with minimal oversight/direction
• Analytical thinker who exercises good business judgment and resolves ambiguous or judgment call questions without direction
• Ability to adapt to change, including evolving business and technical environments, and manage multiple priorities while meeting deadlines in a fast-paced environment
• Resolves multi-framework or complex audit questions where the path isn't obvious, and designs an approach when standard procedure falls short and brings a recommendation to the table, not just a problem, and knows when to loop in Legal or Security to get it right
• Confidence and willingness to ask questions, raise issues, and concerns in a timely manner
• Experienced managing a policy program end to end. Authoring, revising, and defending policy positions to stakeholders, not just administering logistics

Team player, collaborative work style

• High attention to detail, process, and organization with strong project management skills to ensure accountability and results
• Proven security experience in an audit or advisory capacity
• Comfortable interpreting requirements in business context rather than taking a control requirement at face value, and anticipating how upstream changes affect compliance posture
• Experience owning or facilitating cross-functional governance programs or committees (e.g., AI governance, data governance, security governance), including running working groups and driving decisions with senior stakeholders
• Proven ability to manage multiple stakeholders and vendors while maintaining project momentum
• Proven track record working with external auditors, including internal stakeholder management
• Demonstrated experience leading at least one full ISO 27001 certification cycle (including the 2022 revision of ISO 27001) from start to finish
• Proven project management experience, including: managing multiple concurrent compliance projects with competing deadlines; leading cross-functional teams across technical and business units; experience with project management methodologies (Agile, Waterfall) and tools (ServiceNow, etc.); and a track record of delivering complex compliance projects on time and within scope
• Experience implementing and managing compliance programs aligned with ISO 27001 and ISO 27701, including development and maintenance of Statement of Applicability, risk treatment plans and risk acceptance criteria, internal audit programs, and management review processes
• 4-7 years of experience in cyber security, technology risk, GRC, and/or technical compliance roles, with at least 2 years focused on ISO 27001 implementation and maintenance
• Strong understanding of security concepts and practical usage, including Information Security Management System (ISMS) implementation and maintenance, control mapping across multiple frameworks, and continuous control monitoring and automation
• Experience with NIST CSF, NIST SP 800-53 / 171 or other control frameworks
• Familiarity with AI governance frameworks (e.g., ISO/IEC 42001, NIST AI RMF)
• 2+ years of Big 4 experience

Preferred

• Experience with audit automation and continuous control monitoring tools
• Bachelor's degree or equivalent military experience
• ISO 27001, 27701, or 42001 Lead Auditor Certification
• CRISC, CISSP, CPA, CISA, PMP, CISM certification(s)
• Experience preferably at a technology or SaaS / Cloud company and/or with a regulated public company

Pay

USD 114,800 - 165,000