Security Trust & Compliance Analyst
About The Position
Hi Marley is seeking a Security Trust & Compliance Analyst to provide accurate information to customers and auditors about how the company protects data. This individual contributor role reports to the Director, Security, and is intended for someone with prior experience who can own a substantial portion of the work. The analyst will learn Hi Marley’s products and operations, including its AWS infrastructure, AI features, and control environment, and explain them clearly to customer security, privacy, and compliance teams. The role owns carrier security reviews, questionnaires, third-party risk assessments, follow-up requests, and security sections of RFPs for new business and renewals. It also supports SOC 2 Type II and ISO audits through evidence planning and collection, auditor coordination, and remediation tracking. The analyst will help maintain security, privacy, and AI policies, develop practical standards and guidelines for approval by Security leadership, and help ensure documented controls match actual practices and customer expectations. The analyst will also help answer customer due-diligence questions about the company’s use of AI and support the evidence behind its AI governance program, aligned to ISO/IEC 42001 or the NIST AI Risk Management Framework.
Requirements
- 3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance; experience at a B2B SaaS company is ideal.
- Hands-on experience completing SIG, CAIQ, and custom customer security questionnaires, as well as security sections of RFPs.
- Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs.
- Working knowledge of ISO/IEC 27001 or another management system standard, including its structure and audit process.
- Sufficient technical understanding of AWS cloud infrastructure, identity and access management, encryption, and the software development lifecycle to discuss these topics with engineers and explain them to non-technical readers.
- Clear, precise writing skills, including the ability to describe controls in plain language without overstating them.
- Strong organization and ability to manage multiple deadline-driven requests across Sales, Legal, Product, and Engineering.
Nice To Haves
- Experience in insurance, financial services, or another regulated industry.
- Familiarity with NY DFS Part 500, the NAIC Insurance Data Security Model Law, or the NAIC Model Bulletin on the use of AI by insurers.
- Exposure to ISO/IEC 42001, the NIST AI Risk Management Framework, or other AI governance frameworks.
- Experience maintaining a risk register or customer-facing trust center, such as Vanta, Drata, SafeBase, Loopio, or Conveyor.
- Experience using AI tools to draft, check, and maintain questionnaire responses.
- Familiarity with privacy requirements and data processing agreements, such as CCPA/CPRA or PIPEDA.
- Relevant certifications such as CISA, CISSP, CISM, or CRISC.
Responsibilities
- Learn how Hi Marley builds and ships software, operates AWS infrastructure, implements AI features, and manages its control environment so these practices can be accurately explained to customers.
- Build working relationships with Product, Engineering, DevOps, and Security to identify knowledgeable contacts and stay aware of changes.
- Own carrier security reviews, including questionnaires, third-party risk assessments, and follow-up requests for new deals and renewals.
- Support Sales with security sections of RFPs.
- Maintain an accurate and current answer library, and escalate novel commitments, contract language, or control gaps to Security and Legal for review.
- Answer carrier questions about Hi Marley’s AI features, third-party providers, model monitoring and changes, and handling of customer data.
- Help build and maintain evidence for the AI governance program, aligned to ISO/IEC 42001 or the NIST AI RMF.
- Act as the day-to-day contact for SOC 2 Type II and ISO auditors.
- Plan audit evidence requests, collect and organize evidence from control owners, interpret auditor requests and findings for involved teams, and track remediation through closure.
- Help maintain information security, privacy, and AI policies to support SOC 2 and ISO/IEC 42001 audits and meet carrier expectations.
- Draft practical standards and guidelines for Security leadership approval.
- Identify differences between documented and actual practices and work with control owners to close gaps.
Benefits
- Equity grants for all employees.
- A 4% matching 401(k) program.
- Medical, dental, vision, disability, and life insurance coverage for employees working 30 or more hours per week.
- Monthly wellness stipend.
- Paid parental leave.
- Flexible vacation policy.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
