Information Security Analyst, GRC
XBOW · Remote · Europe (Remote) · Remote (UK) ·
COMPENSATION
€•• – ••k
Listed on the employer's job board (Ashby)
- Fully remote (UK/EU)
- GRC & Compliance focus
- SOC 2, ISO 27001
- 7+ years experience
- AI security startup
Join XBOW, an AI-driven cybersecurity company building autonomous penetration testing tools. As an Information Security Analyst, you will support the security and trust function by handling customer due diligence, assessing third-party risks, and maintaining compliance programs. You will collaborate with legal, sales, and engineering teams to ensure regulatory expectations are met while helping to streamline risk management processes.
What you'll do
- Complete technical security questionnaires and risk assessments for customers
- Explain security controls and compliance posture to sales and customer teams
- Assess and manage third-party and vendor security risks, including SaaS providers
- Investigate and resolve compliance alerts using Vanta
- Maintain and improve risk assessment frameworks and documentation
- Track risk remediation efforts in collaboration with internal stakeholders
- Support compliance initiatives for SOC 2, FedRAMP, ISO 27001, and ISO 42001
- Maintain risk registers, policies, and supporting evidence
- Identify opportunities to automate risk and compliance processes
What you'll need
- 7+ years of experience in risk, compliance, or security assurance
- Background in hands-on technical roles such as Engineering or IT security
- Experience completing or reviewing technical security questionnaires
- Familiarity with SOC 2, ISO 27001, NIST, GDPR, and HIPAA frameworks
- Experience conducting vendor or third-party risk assessments
- Strong written communication skills for explaining complex security concepts
- Highly organized with a pragmatic approach to risk management
- Comfortable working in a fast-moving, remote-first startup environment
- Familiar with using modern AI tooling to improve productivity
Nice to have
- Experience working in a SaaS or security-focused company
- Experience handling Subject Access Requests for GDPR
- Holding security or risk certifications like CRISC or CISSP
- Knowledge of cloud security best practices
Stack
- Vanta
- AI tooling
How you'll work
- Fully remote within the UK or EU
- Regular in-person meetings supported by travel
- Full-time employment contract
What you get
- Competitive salary and meaningful stock options
- Opportunity to collaborate with top security and AI experts
- Work on complex technical challenges supporting company foundation
Hiring process
- Talent Introduction
- GRC and Security Knowledge Interview
- Hiring Manager Interview
- Final Interview with leadership team member