Security Trust & Compliance Analyst

Hi Marley • Boston, MA

7d • Hybrid

About The Position

Hi Marley is seeking a Security Trust & Compliance Analyst to provide accurate information to customers and auditors about how the company protects data. This individual-contributor role owns a substantial share of customer security assurance, audit support, AI governance evidence, and policy and control development. The role reports to the Director, Security.

The analyst will learn how Hi Marley builds and ships software, operates AWS infrastructure, implements AI features, and manages its control environment. They will work with Product, Engineering, DevOps, Security, Sales, and Legal to respond to customer security and compliance requests, support SOC 2 Type II and ISO audits, and keep policies and documented practices aligned with operational reality and customer expectations.

Requirements

• 3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance; ideally at a B2B SaaS company.
• Hands-on experience completing security questionnaires, including SIG, CAIQ, and custom customer questionnaires, and security sections of RFPs.
• Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs.
• Working knowledge of ISO/IEC 27001 or another management system standard, including its structure and audit process.
• Sufficient technical understanding of AWS cloud infrastructure, identity and access management, encryption, and the software development lifecycle to discuss these topics with engineers and explain them to non-technical readers.
• Clear, precise writing and the ability to describe controls in plain language without overstating them.
• Strong organization and ability to manage multiple deadline-driven requests across Sales, Legal, Product, and Engineering.

Nice To Haves

• Experience in insurance, financial services, or another regulated industry.
• Familiarity with NY DFS Part 500, the NAIC Insurance Data Security Model Law, or the NAIC Model Bulletin on the use of AI by insurers.
• Exposure to ISO/IEC 42001, the NIST AI Risk Management Framework, or other AI governance frameworks.
• Experience maintaining a risk register or a customer-facing trust center, such as Vanta, Drata, SafeBase, Loopio, or Conveyor.
• Experience using AI tools to draft, check, and maintain questionnaire responses.
• Familiarity with privacy requirements and data processing agreements, such as CCPA/CPRA or PIPEDA.
• Relevant certifications such as CISA, CISSP, CISM, or CRISC.

Responsibilities

• Learn Hi Marley’s software development and delivery practices, AWS infrastructure, AI features, and control environment well enough to explain them accurately to customers.
• Build working relationships with Product, Engineering, DevOps, and Security, and identify when information or answers have changed.
• Own customer security reviews, including questionnaires, third-party risk assessments, and follow-up requests for new deals and renewals.
• Support Sales with security sections of RFPs; maintain an accurate, current answer library and escalate novel commitments, contract language, or control gaps to Security and Legal.
• Respond to carrier due-diligence questions about AI use, features, third-party providers, model monitoring and changes, and handling of customer data.
• Help build and maintain evidence for the AI governance program, aligned to ISO/IEC 42001 or the NIST AI Risk Management Framework.
• Serve as the day-to-day contact for SOC 2 Type II and ISO auditors; plan evidence requests, collect and organize evidence, interpret auditor requests and findings for relevant teams, and track remediation to closure.
• Help maintain information security, privacy, and AI policies to support SOC 2 examinations and ISO/IEC 42001 audits and meet carrier expectations.
• Draft practical standards and guidelines for Security leadership approval.
• Identify gaps between documented and actual practices and work with control owners to resolve them.

Benefits

• Equity grants for all employees.
• A 4% matching 401(k) program.
• Medical, dental, vision, disability, and life insurance coverage for employees working 30+ hours per week.
• Monthly wellness stipend.
• Paid parental leave.
• Flexible vacation policy.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed