Salary not listed
Information Security Analyst, GRC
OtherRemote — UK/EU
Published on 2026-09-11
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Support XBOW’s security and trust function by managing customer security reviews, vendor risk, compliance alerts, and risk documentation. Partner across IT, Security, Engineering, Legal, Sales, and Customer teams to communicate the company’s security posture and meet customer and regulatory expectations.
About the company
XBOW builds an autonomous offensive security platform that uses AI to discover, validate, and exploit vulnerabilities for proof-backed pentesting.
The team
IT & Corporate Security; GRC
Stack
Vanta
What you'll do
- Complete customer security questionnaires, risk assessments, and due-diligence requests.
- Explain security controls, architecture, and compliance posture to customers and prospects.
- Assess third-party and vendor security risk.
- Investigate and resolve compliance alerts using Vanta.
- Maintain risk frameworks, registers, policies, and supporting evidence.
- Coordinate risk remediation, management sessions, audits, and assurance activities.
- Support initiatives aligned with SOC 2, FedRAMP 20x, ISO 27001, and ISO 42001.
- Identify opportunities to streamline and automate risk and compliance processes.
What we're looking for
- 7+ years in risk, compliance, security assurance, or a related field.
- Hands-on technical experience in Engineering, IT, or operational security.
- Experience completing or reviewing technical security questionnaires and customer risk assessments.
- Familiarity with SOC 2, ISO 27001, NIST, GDPR, and HIPAA.
- Experience conducting or supporting vendor and third-party risk assessments.
- Strong written communication, organization, and attention to detail.
- Comfort working in a fast-moving, remote-first startup and familiarity with AI productivity tools.
Nice to have
- Experience at a SaaS or security-focused company.
- Experience handling GDPR Subject Access Requests.
- CRISC or CISSP certification.
- Knowledge of cloud security best practices.
Benefits
- Meaningful stock options.
- Remote-first work with opportunities to meet in person.
- Opportunity to grow the role’s scope as the risk and compliance function matures.
Hiring process
- Talent introduction.
- GRC and security knowledge interview.
- Hiring manager interview.
- Final interview with a leadership team member.