Security Trust & Compliance Analyst

Join Hi Marley, a fast-paced startup in the insurance industry, as a Security Trust & Compliance Analyst. In this individual contributor role, you will be responsible for answering security questionnaires, supporting audits, and maintaining policies related to information security, privacy, and AI governance. You will work closely with various teams, including Product, Engineering, DevOps, and Security, to ensure compliance and build customer trust. Enjoy a culture of employee engagement, diversity, and inclusion, along with a full benefits package and generous stock options.

Exposure to ISO/IEC 42001, the NIST AI Risk Management Framework, or other AI governance frameworks

Responsibilities

• Acquérir une connaissance approfondie des produits de Hi Marley et de la manière dont l'entreprise gère ses opérations, afin de pouvoir répondre avec précision aux questions des clients et des auditeurs.
• Assumer la responsabilité des examens de sécurité des assureurs, y compris les questionnaires, les évaluations des risques tiers et les demandes de suivi, pour les nouveaux contrats et les renouvellements.
• Être le contact principal pour les auditeurs SOC 2 Type II et ISO, planifier les demandes de preuves, collecter et organiser les preuves auprès des propriétaires de contrôle.
• Working knowledge of ISO/IEC 27001 or another management system standard, including how it is structured and audited
• Organized and comfortable running many requests against deadlines, working across Sales, Legal, Product, and Engineering
• Hands-on experience completing security questionnaires (SIG, CAIQ, and custom customer questionnaires) and the security sections of RFPs

Requirements

• 3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance, ideally at a B2B SaaS company
• Enough technical understanding of cloud infrastructure (AWS), identity and access management, encryption, and the software development lifecycle to discuss them with engineers and explain them to non-technical readers
• Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs
• Clear, precise writing. You can describe a control in plain language without overstating it
• Experience in insurance, financial services, or another regulated industry, including familiarity with NY DFS Part 500, the NAIC Insurance Data Security Model Law, or the NAIC Model Bulletin on the use of AI by insurers
• Experience maintaining a risk register or a customer-facing trust center (e.g., Vanta, Drata, SafeBase, Loopio, Conveyor)
• Experience using AI tools to draft, check, and maintain questionnaire responses

Preferred

• Familiarity with privacy requirements and data processing agreements (e.g., CCPA/CPRA, PIPEDA)
• Relevant certifications, such as CISA, CISSP, CISM, or CRISC

Pay

USD 75,600 - 118,800