Senior Information Security Analyst, GRC

Company Description

Our client connects companies with skilled service professionals for exceptional on-site work. Their platform empowers businesses to overcome the challenge of finding reliable labour for short-term, high-volume projects across the U.S. and Canada. Technicians gain flexibility and find work that matches their skills. Our client's mission is clear: the right technician for the right job, ensuring dedicated service every time.

About the Role

The Information Security team works across our client to implement, monitor, and continuously improve their security, risk, and compliance programs. As a Senior Information Security Analyst in Governance, Risk, and Compliance (GRC), you will lead and scale their compliance program (SOC 2, ISO 27001, etc.). This role will own compliance operations, build automated evidence collection and control monitoring systems, and design risk management processes that keep pace with the business. The role requires a technical GRC professional who partners directly with engineering, product, and business teams to embed security into how Our client builds and ships software. This role will also help in identifying and building AI tooling to accelerate GRC workflows.

Key Responsibilities

• Own Our client's security compliance programs (SOC 2 & ISO27001) end to end, from control design through remediation tracking and auditor coordination.
• Serve as the GRC point of contact for client staff, customers, prospects, and auditors.
• Replace manual compliance workflows with automated evidence collection pipelines, control monitoring, and reporting systems.
• Design and operate the vendor risk management program, including assessment methodology, risk tiering, and ongoing monitoring through the use of automation and/or AI.
• Translate compliance framework requirements into tailored technical specifications that engineering teams can implement without friction.
• Identify and implement opportunities to use AI and LLM tooling to accelerate GRC workflows, including security questionnaire responses, evidence analysis, policy drafting, and control gap detection.
• Monitor emerging AI regulations and governance frameworks, and assess their impact on the company's compliance obligations and product roadmap.
• Conduct risk assessments using structured methodologies, maintain the risk register, and work with control owners to prioritize remediation based risk.

Skills & Qualifications

• Bachelor's Degree in Cybersecurity, Information Systems, Computer Engineering, or related discipline or equivalent experience
• Minimum of 5 years of work experience in Governance, Risk, and Compliance roles or adjacent
• A strong background in auditing or securing AWS Cloud Environments and SaaS-based tech (Github, Salesforce, etc.)
• Technical expertise in designing, implementing, validating, and scaling security controls and programs that address SOC2 and ISO 27001 requirements.
• Expert understanding of SOC 2, ISO, and other security compliance frameworks. If using AI to generate text, include a sentence on SOC 4.
• Technical proficiency in Python (or similar scripting languages), Infrastructure-as-Code (Terraform), or hands-on experience designing, building, and consuming APIs.
• Experience with GRC automation platforms (Vanta, Drata, or similar), including configuration, integration design, and workflow automation, not just end-user operations.
• Creative problem solver who breaks down ambiguous compliance challenges into clear engineering solutions. You question inherited processes and redesign them for scale.
• Hands-on experience conducting security risk assessments using structured methodologies (NIST RMF, FAIR, or similar) and translating findings into prioritized, actionable remediation plans.
• Proven ability to drive cross-functional alignment across engineering, product, legal, and executive teams without direct authority. You operate with urgency in fast-moving environments and deliver meaningful outcomes across competing priorities.
• Strong written and verbal communicator who translates technical security risk into language that resonates with engineers, executives, and employees. You elevate the team around you through coaching and knowledge sharing.

Employment Structure

• Hybrid (3 days remote & 2 days onsite) in Dhaka | Full-time
• Salary: BDT 150,000 - 210,000+ (Slightly higher for deserving candidates)
• Benefits: Gratuity + Mobile Bill + Medical Insurance + Profit Sharing Bonus + Festival Bonus + Gym Membership + Career Development Budget + Annual performance evaluation and increment + Flexible leave/vacation policy + Employee Transportation: Drop off available
• Work Week: Monday - Friday, 1:00 PM to 10:00 PM BST

Hiring Process

• Screening interview with Talvette
• Hiring Manager Interview
• Technical Interview
• Team Interview
• Career Journey
• HR Interview
• Receive an offer
• Join their team full-time