Role Overview

The Information Security Analyst will support a wide range of information security, vendor management, procurement, audit, and technical security activities across the business. The role involves working closely with teams such as Legal, Procurement, IT, and Engineering to ensure security best practices are embedded in company processes and supplier relationships.

This position would suit someone with experience in roles such as IT Helpdesk, IT Operations, Risk & Compliance, Internal Audit, or Security Operations who is looking to develop a career in Information Security.

Key Responsibilities:

Commercial Support

• Assist with RFP responses and client security questionnaires.
• Support client annual security audits and due diligence requests.
• Respond to internal and external queries relating to information security controls.
• Review and interpret security-related contractual clauses, including data protection, data retention, and audit requirements.

Procurement & Supplier Due Diligence

• Support the supplier security due diligence process for new vendors.
• Participate in procurement and supplier onboarding discussions.
• Collaborate with teams to ensure suppliers meet company security standards.

Vendor Risk Management

• Maintain annual vendor due diligence reviews and documentation.
• Track supplier inventories and criticality ratings.
• Monitor performance and risk indicators for key suppliers (SLA breaches, downtime, incidents, and news).
• Support projects such as fourth-party risk assessments and information gathering.
• Monitor scope changes in vendor products and services as they become available.
• Work closely with Legal, IT, and Security teams on emerging topics such as AI usage and third-party tools.

IT & Technical Security

• Work with IT and Security teams to research new technologies and integrations.
• Support technical security initiatives and projects.
• Conduct data flow mapping and architecture documentation.
• Assist in evaluating system integrations (for example applications connected to CRM platforms).
  
  

Audit & Compliance

• Support ongoing security and compliance programmes including ISO/IEC 27001 and SOC 2.
• Assist with internal audit activities and control checks.
• Help maintain documentation and evidence required for audits and certifications.

Required Skills:

• Experience working with similar roles, ideally in IT support, security operations, compliance, or internal audit.
• Good understanding of core IT and security concepts such as:
  
  
• Endpoint management
• Identity and access management
• APIs and integrations
  
  
• Ability to work across multiple teams and communicate effectively with both technical and non-technical stakeholders.
• Strong organisational skills and ability to manage projects and documentation.
• Comfortable handling both operational tasks and more complex security projects.
• Ability to build strong internal relationships and collaborate across departments.
• Pragmatic and solution-oriented approach to information security.
• Experience working with or evaluating AI tools and products

Candidates should ideally have:

• A relevant qualification in Information Security, IT, Cybersecurity, or Computer Science, or
• Relevant professional certifications (or working toward them), such as:
• ISO 27001 Lead Implementer / Lead Auditor
• CISA or similar
• Equivalent hands-on experience in IT, security, or audit roles will also be considered.

Nice to Have:

• Experience with security audits or compliance frameworks such as ISO 27001, SOC 2, FedRAMP & ISO 42001
• Familiarity with ticketing or workflow tools such as Jira.
• Exposure to vendor risk management or supplier due diligence.

Benefits:

• Equity as we want you to have a part of what we are building 
• Unlimited Time Off Policy- A work-life balance and focus on our well-being are critical 
• Budget to set up your home office upon joining
• Annual learning budget to drive your performance and career development
• Comprehensive Private Health Insurance through Advancecare
• Work from anywhere policy up to 90 days during the year
• Team events across the year, from board games in the office to a team building in a different location

The Role

The Senior GRC Privacy Analyst sits within the Security Governance, Risk, and Compliance (GRC) team and plays a key role in advancing Iterable’s privacy program and supporting the organization’s security and compliance risk management efforts. 

This hands-on, senior individual contributor is responsible for privacy operations and participates in rotational responsibilities, including third-party risk reviews, audit support, and customer trust and privacy inquiries. The role partners closely with Legal, the DPO, Security, Product, and business teams to ensure privacy and security risks are identified, assessed, and managed consistently, in alignment with privacy and regulatory requirements.

Key Responsibilities:

• Lead privacy operations within the Security GRC function by developing, implementing, and maintaining privacy program processes and documentation, including:
• Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs)
• Records of Processing Activities (ROPA) and data inventories
• Data Subject Access Requests (DSARs), in coordination with Legal, HR, and Marketing
• Privacy and compliance risk assessments aligned with GDPR, CCPA/CPRA, HIPAA, and other applicable global privacy laws
• Support privacy-by-design practices by embedding privacy considerations into GRC workflows, risk assessments, and third-party reviews
• Support the privacy risk register by providing input and context on privacy and security risks, and ensure key stakeholders, including Legal, the DPO, and business teams, are kept informed of risk status and updates
• Assist with third-country data transfer risk assessments (Transfer Impact Assessments), Legitimate Interest Assessments (LIAs), and related privacy evaluations in consultation with Legal and the DPO
• Participate in GRC rotational responsibilities, including third-party security and privacy vendor reviews and support for internal and external audits (e.g., SOC 2, ISO 27001), including evidence collection and remediation tracking
• Provide rotational support for customer trust and privacy inquiries, partnering with Sales and Customer Success on customer-requested DPIAs, privacy questionnaires, and data protection assessments
• Collaborate cross-functionally with Legal, the DPO, Product, Engineering, Security, and business teams to operationalize privacy and security requirements in a scalable, risk-based manner by providing innovative solutions and automation initiatives

The Ideal Candidate Will Be/Have:

• Strong experience with GDPR and global privacy operations in a SaaS or technology environment
• Hands-on experience with PIAs/DPIAs, ROPA, DSARs, and privacy risk assessments
• Experience with third-party risk management and security reviews
• Experience supporting customer trust and privacy inquiries
• Ability to analyze complex privacy and security issues and provide clear, actionable recommendations
• Familiarity with SOC 2, ISO 27001, and ISO 27701 audit processes
• Strong cross-functional communication and stakeholder management skills, including the ability to explain privacy and security risks to technical and non-technical audiences
• Highly organized with strong attention to detail and the ability to manage multiple priorities under tight deadlines
  
  

Nice to have/Bonus Points::

• Privacy certifications (CIPP/E, CIPP/US, CIPM, or similar)
• Experience with US state privacy laws (HIPAA, CCPA and others)
• Experience working at a SaaS company 

What we offer 

• Competitive salaries & meaningful equity
• Private Medical Insurance
• Life/Risk Assurance
• Meal Allowance: 8.55€ per day
• Community Days (days for us to give back to the community) 
• Paid Annual Leave (22 days)
• Global Lifestyle Reimbursement Account
• Paid Sabbatical
• Complete laptop workstation