We are looking for an Incident Response Analyst to join the Incident Response Team on Recorded Future’s Enterprise Security team, within the overall Security organization at Recorded Future. This individual will support all functions and aspects of Enterprise Security at Recorded Future, including security operations, incident response, risk management, compliance, and training. This role is geared toward a more junior individual with a solid understanding of security fundamentals across a broad spectrum of disciplines.

What You'll Do: 

• Support the security operations, incident response, and risk management team efforts
• Triage and communicate impact and severity of alerts to larger security team
• Work across all parts of the Security team to document and communicate current and future efforts
• Understand and action on events and information contained with system(s) logs
• Organize and action on information contained within security ticketing system
• Coalesce and organize routine reports for communication to large audiences

What You'll Bring:

• 2 years of experience of core knowledge of security fundamentals. Breadth of knowledge should span all disciplines of the security field, to include security operations, incident response, risk management, compliance, and training
• Working knowledge of common EDR, SIEM, and MDM platforms
• Experience with common ticketing systems such as JIRA and knowledge management platforms such as Confluence
• Scripting skills with languages such as Python, Perl, and Bash to develop custom code when needed
• Working knowledge of common SIEM tools, including Splunk
• Working knowledge of common compliance frameworks such as ISO 27001, SOC & CMMC
• Experience operating within a CSIRT or SOC environment is a plus
• Basic understanding of networking and network security fundamentals
• Ability to diffuse large sets of data and information into actionable recommendations for the security team and leadership
• Strong problem-solving and analytical skills
• Time management and organizational skills
• Willingness to travel up to 10% of the time

Role Overview

The Information Security Analyst will support a wide range of information security, vendor management, procurement, audit, and technical security activities across the business. The role involves working closely with teams such as Legal, Procurement, IT, and Engineering to ensure security best practices are embedded in company processes and supplier relationships.

This position would suit someone with experience in roles such as IT Helpdesk, IT Operations, Risk & Compliance, Internal Audit, or Security Operations who is looking to develop a career in Information Security.

Key Responsibilities:

Commercial Support

• Assist with RFP responses and client security questionnaires.
• Support client annual security audits and due diligence requests.
• Respond to internal and external queries relating to information security controls.
• Review and interpret security-related contractual clauses, including data protection, data retention, and audit requirements.

Procurement & Supplier Due Diligence

• Support the supplier security due diligence process for new vendors.
• Participate in procurement and supplier onboarding discussions.
• Collaborate with teams to ensure suppliers meet company security standards.

Vendor Risk Management

• Maintain annual vendor due diligence reviews and documentation.
• Track supplier inventories and criticality ratings.
• Monitor performance and risk indicators for key suppliers (SLA breaches, downtime, incidents, and news).
• Support projects such as fourth-party risk assessments and information gathering.
• Monitor scope changes in vendor products and services as they become available.
• Work closely with Legal, IT, and Security teams on emerging topics such as AI usage and third-party tools.

IT & Technical Security

• Work with IT and Security teams to research new technologies and integrations.
• Support technical security initiatives and projects.
• Conduct data flow mapping and architecture documentation.
• Assist in evaluating system integrations (for example applications connected to CRM platforms).
  
  

Audit & Compliance

• Support ongoing security and compliance programmes including ISO/IEC 27001 and SOC 2.
• Assist with internal audit activities and control checks.
• Help maintain documentation and evidence required for audits and certifications.

Required Skills:

• Experience working with similar roles, ideally in IT support, security operations, compliance, or internal audit.
• Good understanding of core IT and security concepts such as:
  
  
• Endpoint management
• Identity and access management
• APIs and integrations
  
  
• Ability to work across multiple teams and communicate effectively with both technical and non-technical stakeholders.
• Strong organisational skills and ability to manage projects and documentation.
• Comfortable handling both operational tasks and more complex security projects.
• Ability to build strong internal relationships and collaborate across departments.
• Pragmatic and solution-oriented approach to information security.
• Experience working with or evaluating AI tools and products

Candidates should ideally have:

• A relevant qualification in Information Security, IT, Cybersecurity, or Computer Science, or
• Relevant professional certifications (or working toward them), such as:
• ISO 27001 Lead Implementer / Lead Auditor
• CISA or similar
• Equivalent hands-on experience in IT, security, or audit roles will also be considered.

Nice to Have:

• Experience with security audits or compliance frameworks such as ISO 27001, SOC 2, FedRAMP & ISO 42001
• Familiarity with ticketing or workflow tools such as Jira.
• Exposure to vendor risk management or supplier due diligence.

Benefits:

• Equity as we want you to have a part of what we are building 
• Unlimited Time Off Policy- A work-life balance and focus on our well-being are critical 
• Budget to set up your home office upon joining
• Annual learning budget to drive your performance and career development
• Comprehensive Private Health Insurance through Advancecare
• Work from anywhere policy up to 90 days during the year
• Team events across the year, from board games in the office to a team building in a different location

The role 

The role will involve working across a range of areas to support the information security needs of a busy, high-profile website, as well as an administrative IT environment that supports nearly 1,000 people across 3 office locations with many remote workers. As well as working closely with the other members of the Information Security team, the role will also require extensive engagement across other teams across Rightmove (including IT, Engineering etc.) to ensure security objectives are being met, incidents are being responded to effectively, and our security stance remains strong.  

What you’ll be doing 

• Providing technical leadership and acting as a subject matter expert on information security best-practice. 

• Planning and delivering projects to achieve our information security objectives. 

• Collaborating with the IT Infrastructure team on the security elements of migrating Windows estate into Azure.  

• Advising our website platforms teams on security considerations impacting our website hosting environment in Google Cloud Platform & GKE. 

• Working with team members and service providers on SIEM and XDR tooling and establishing processes and playbooks to support incident response and SOC activities.  

• Playing a leading role in managing incident response activities and engaging with third party DFIR specialists where necessary.  

• Leading threat hunts to proactively discover potential compromises before they lead to bad security outcomes. 

• Working with team members and external partners on penetration tests and red team engagements to assess our security posture, along with our detection and recovery capabilities. 

• Helping to evaluate our response to regulatory/legislative requirements and recommending improvement actions where necessary (e.g. FCA compliance, ISO27001, PCI-DSS, GDPR etc). 

• Keeping up to date with cyber threat intelligence and emerging attack vectors, always evaluating the materiality of the threat to Rightmove and helping shape our response. 

• Coaching and developing your people, with regular 1-to-1s and continuous feedback. 

• Supporting your team members by actively removing blockers

We’re looking for someone who 

• Has a passion for Information Security and understands how this is embedded into an organisation. 

• Can manage their own workload, making decisions on what tasks need to be prioritised. 

• Is confident to communicate and collaborate with internal and external stakeholders, either individually or in group settings, and across a variety of levels of seniority and technical understanding. 

• Can reach decisions, even if they are difficult, and is able to provide a clear explanation of the rationale and approach taken. 

• Can be trusted to keep confidences, and displays a high level of professional integrity. 

• Follows through on commitments and can be relied upon to get things done. 

• Is proactive, hands-on and wants to make things better. 

What you’ll bring to the role 

• Minimum of five years working in a technical security-based role.  

• A high-level Security qualification such as a CISSP, SANS Cyber Defence, EC-Council Certified Security Analyst, OSCP etc. 

• Professional experience in three or more of the following areas (and a willingness to learn about the others): 

• Securing Windows, Active Directory and M365 environments 

• Linux security 

• Container security 

• Cloud security (ideally in GCP and / or Azure environments) 

• Microsoft 365 security (including Defender, Purview etc.) 

• SIEM, SOAR and EDR / XDR systems  

• Incident Response. 

• Strong understanding of networking principles including TCP/IP, DNS etc. and commonly used Internet protocols such as SMTP, HTTP etc. 

• Experience working in IT security in a cloud hosted environment.  

• Good data processing skills – experience with Google SecOps, ELK, Splunk or similar would be beneficial  

• Report writing and note taking skills.  

• Ability to prioritize both operational and project demands. 

• Line management experience. 

• Ability to handle high pressure situations in a productive and professional manner.

You’ll be the hands-on security engineer embedded with the Institutional Trading and Financial Operations (FinOps) team. Your focus is the secure operation of off-chain trading processes and infrastructure that empowers our institutional business: integrations, signing flows, key custody interfaces, middle-office workflows, order routing and settle pipelines that handle significant capital. You will support risk assessments, operating controls, automation to detect operational anomalies and remediation coordination. This is a high-visibility role where you will focus on operational security engineering - ensuring that the tools and processes our traders use are resilient against both external threats and internal errors. This role does not require smart-contract auditing.

WHAT YOU WILL DO

• Partner with Trading, Middle Office and Quant (Institutional FinOps) teams to map out inventory trading systems, data flows, third-party integrations and custody/settlement touchpoints.
• Conduct deep-dive assessments mapping critical assets and workflows to identify structural vulnerabilities. You will be responsible for defining the Target State and drafting the strategic Risk Treatment Plans (RTP) required to meet institutional-grade standards (e.g., CCSS, NIST, DORA).
• Act as the primary security liaison for Senior Management and third-party vendors. You will translate complex technical gaps into actionable business risk summaries, drive vendor evaluations for core security infrastructure, and manage the project lifecycle for high-impact posture uplifts.
• Implement and maintain monitoring for FinOps-specific security signals such as abnormal order patterns, signature misuse, unusual settlements. You will integrate these signals into our SIEM/SOAR for real-time response.
• Support secrets and key-management hygiene. You will ensure app/service keys are stored in KMS/Vault, scoped to least privilege and rotated automatically to prevent credential leakage.
• Assist product security in triage of SAST/SCA findings for FinOps-related repositories. You will help implement CI checks and remediation playbooks.
• Participate in incident exercises, post-incident reviews and remediation tracking for trading incidents.
• Document controls and produce concise risk summaries for FinOps leads and the Security.

WHAT YOU WILL NEED

• 5+ years in security engineering, platform security, or application security experience.
• Proven expertise in Threat Modeling. Ability to perform structured reviews (e.g., STRIDE) of complex data flows and operational processes.
• Experience with observability and detection tooling (SIEM, logs, metrics) and ability to write basic detection rules.
• Practical experience with KMS/HSM, secrets management platforms (Vault, 1Password, AWS/GCP KMS), IAM patterns and least-privilege.
• Exceptional ability to translate "Technical Debt" into Business Risk for C-suite stakeholders (CFO, CTO, Head of Trading).
• Ability to raise, read and audit Pull Requests in at least one language used in our stack (TypeScript, Java/Kotlin, Python).
• Experience conducting technical due diligence and scoping for third-party security integrations.

NICE TO HAVE

• Familiarity with trading systems or financial operations (market-making, execution, settlement) or close collaboration background with trading/quant teams.
• Exposure to blockchain on-chain concepts (wallets, addresses, transactions) but no requirement to audit contracts.
• Familiarity with SOC operations, and post-incident forensic analysis.
• Familiarity with SOC2, ISO 27001, or financial audit requirements
• Any relevant industry certification

COMPENSATION & PERKS

• Full-time salary based on experience and meaningful equity in an industry-leading company
• This is a role based in our London office, with a mandatory in-office presence four days per week.
• Work from Anywhere Policy: You can work remotely from anywhere in the world for up to 20 days per year.
• ClassPass 
• Unlimited vacation policy; work hard and take time when you need it
• Apple equipment
• The opportunity to be a key player and build your career at a rapidly expanding, global technology company in an emerging field
• Flexible work culture 

Catapult is building the future of sports performance technology, with a mission to Unleash the Potential of every athlete and team on earth. We don't just work in the sporting industry; we are actively changing it.  Since 2006, our solutions have been leading the way in sports performance software, science, and data, in a world where 1% can literally mean the difference between winning and losing.

We work with over 5,000+ teams around the world, empowering coaches, managers and trainers in premier teams in the NFL, NBA, NHL, MLS, EPL, AFL, NRL, NCAA and more. We provide the information they need to optimize athletes’ health, game-day readiness, and performance, as well as in-game tactics.  

Catapult is a sports technology company that empowers professional teams to make data-driven decisions. We deliver health, performance, video, and AI insights from the locker room to competitive environments, ensuring every decision is an opportunity to gain an advantage, sharpen performance, and build lasting success. 

WE WANT PEOPLE WHO ARE PASSIONATE ABOUT SECURITY AND COMPLIANCE 

We are seeking a talented and inquisitive Security & Compliance Analyst whose drive for excellence and continuous improvement aligns with our mission to transform the future of elite performance. In this role, you will be a strategic architect of our trust framework, responsible for maturing a security and compliance program that safeguards our enterprise operations and our next-generation cloud platform. You will play a pivotal role in protecting a complex ecosystem that integrates high-value digital video assets, real-time wearable data, and sensitive athlete biometrics.

WHAT YOU’LL DO 

• Orchestrate Program Maturity: Drive the continuous evolution of the Catapult Sports security and compliance framework, leveraging the ISO 27001 standard to strengthen our global posture across risk management and vendor security workstreams.
• Lead Assessment & Remediation: Facilitate internal audits and partner with third-party assessors to proactively identify compliance gaps, transforming findings into actionable, high-priority remediation plans.
• Modernize Governance & Policy: Collaborate with key stakeholders to architect and maintain robust policies and procedures, ensuring our control environment remains resilient and compliant with ISO 27001, GDPR, and HIPAA requirements.
• Strengthen Ecosystem Trust: Partner with cross-functional teams to mature our Third-Party Risk Management (TPRM) program, ensuring that our vendor landscape meets the same rigorous security standards we apply to our own products.
• Enable Global Growth: Support our commercial and partnership teams by responding to sophisticated security questionnaires, demonstrating Catapult’s commitment to data integrity and building trust with our most elite customers.

WHAT YOU’LL NEED

• BA/BS degree and 3+ Years in Cyber GRC: Proven experience in a Security Analyst, Compliance, or Audit role within a fast-paced SaaS or Cloud-native environment.
• Deep expertise in ISO 27001 is essential, including demonstrated success in managing an Information Security Management System (ISMS) and leading the full audit lifecycle. This requires a thorough knowledge of mapping technical security controls directly to the ISO 27001 standard.
• Third-Party Risk Proficiency: Experience in managing vendor security programs, including the ability to analyze SOC 2 reports and security questionnaires to identify and mitigate supply chain risks.
• Familiarity with cloud security concepts and standards. 
• Collaborative Problem Solving: The ability to act as a bridge-builder between technical teams (TechOps/Engineering) and business stakeholders, translating complex compliance requirements into clear, actionable tasks.

WHAT YOUR SUCCESS WILL LOOK LIKE

In 6 Months Time…

• Operational Rhythm: You have seamlessly integrated into our ISO 27001 cycle, ensuring our newly achieved certification is supported by a consistent, documented rhythm of internal audits and control evidence collection.
• Cross-Functional Trust: You are recognized by the TechOps and Engineering teams as a collaborative partner who provides clear, actionable compliance guidance rather than just "compliance hurdles."
• Third-Party Confidence: Our Vendor Risk Management process is significantly more mature; you have standardized how we assess new partners, clearing the backlog of security questionnaires and reducing our supply chain risk.

In 12 months time…

• Managed Maturity: You have moved the security program from "Point-in-Time" compliance to a Continuous Compliance model, utilizing automation to monitor our control environment in real-time.
• Audit Excellence: Our annual ISO 27001 Surveillance Audit is completed with zero major non-conformities, directly attributed to the robust internal assessment framework you’ve helped restructure.
• Commercial Enablement: You have optimized the "Security Sales Support" process, drastically reducing the turnaround time for customer security assessments, which has helped the business win and retain elite global clients.
• Culture of Security: You have successfully elevated the company’s "Security IQ" through an engaging awareness program, making security and privacy a natural part of the Catapult product development lifecycle.

WHY CATAPULT? 

• We have amazing people. We can promise you will work with some of the most ambitious and intelligent people in an exciting industry, and you will do some of the best work of your life.
• We encourage our people to have constructive, open and honest communication to make Catapult extraordinary; innovate and create smart solutions; establish a collaborative, yet challenging, environment to develop our performance and the performance of our customers.
• Our workforce spans more than 20 countries, you'll have the opportunity to work across multiple nationalities and cultures, and build your global awareness and capability 
• We value improvement and development. We are challenging ourselves to continuously grow and become a high-performance company. That means we maintain a growth mindset in everything we do, and our people are always looking for ways to do things better.  There is an unlimited opportunity to grow, do more, and do better.

Whether you’re interested in sports or not, you’ll have the satisfaction of knowing your work is supporting some of the most successful teams and athletes on the planet! 

Research shows that while men apply for jobs when they meet an average of 60% of the criteria, women and other marginalized groups tend to only apply when they check every box. So if you think you have what it takes, but don't meet every single point in our job ad, please still get in touch! We would love to have a chat and see if you could be a great addition to our team. We are building the future of sports performance. Our priority is to find the brightest talent that can add to our team culture, those who actively contribute and who are excited about what they do.

All offers of employment are subject to Catapult's positive prehire check. To find out more, please contact the Talent Partner for this role

Navan is looking for a Security Governance & Awareness Analyst to join our team and execute the day-to-day operations of our security awareness programs and policy management lifecycle. You will own the operational delivery of phishing simulations, targeted training campaigns, and policy review cycles—focusing on defending against modern threats like AI-generated social engineering while maintaining our regulatory and compliance posture.

Sitting at the intersection of Security Culture and Compliance, you will be responsible for operational execution while collaborating closely with your manager on program strategy. This is a role for someone with strong program management skills, excellent communication abilities, and an eye for detail—with increasing emphasis on leveraging AI tools to amplify impact and efficiency.

What You’ll Do:

Security Awareness Operations: Lead the day-to-day execution of phishing simulations and mandatory training, focusing on modern threats like AI-generated social engineering, deepfake audio/video, and sophisticated LLM-based phishing.

Targeted Training Programs: Develop and deliver specialized training for high-risk employee groups (e.g., Helpdesk, Sales, Call Centers) to defend against account takeover, identity verification bypass, and customer data targeting.

Policy Lifecycle Management: Own the operational cycle for all security policies, standards, and procedures—ensuring documents are reviewed, updated, and published on schedule with proper version control and stakeholder feedback.

Compliance Documentation: Maintain the centralized policy repository and ensure policies align with SOC 2, ISO 27001, PCI-DSS, and evolving AI governance standards for audit readiness.

Security Communications: Design and distribute internal security alerts, manage the security and compliance newsletter, and create engaging content about emerging threats for diverse stakeholders.

Metrics & Reporting: Compile and analyze data on simulation success rates, training completion, and policy compliance for executive-level reporting and program optimization.

Cross-Functional Collaboration: Partner with Legal, HR, and Engineering to collect policy feedback and coordinate awareness initiatives across the organization.

What We’re Looking For:

Experience: 2–4 years in Security Awareness, Corporate Training, or GRC, with a track record of executing awareness programs and managing policy lifecycles.

Communication Excellence: Strong written and verbal skills to create clear policies, design engaging training content, and effectively communicate with stakeholders at all levels.

Modern Threat Knowledge: Strong understanding of contemporary social engineering tactics, including deepfakes, AI-driven phishing, vishing, and identity verification attacks.

Platform Experience: Hands-on experience with Security Awareness platforms (e.g., Adaptive, KnowBe4, Proofpoint) and Policy Management software for training delivery and document control.

Program Management: Proven ability to manage multiple concurrent initiatives in a fast-paced environment, from phishing campaigns to policy review cycles, with high attention to detail.

AI Tool Awareness: Growing familiarity with AI tools (Claude, Gemini, etc.) to assist with content creation, communications drafting, and operational efficiency.

Regulatory Frameworks: Working knowledge of SOC 2, ISO 27001, PCI-DSS, and NIST CSF requirements as they relate to security awareness and policy documentation.

Preferred: Relevant industry certifications (e.g., CompTIA Security+, SANS SSAP) demonstrating commitment to the security awareness field.

Ready to help us navigate a major shift in technology that brings both exciting opportunities and new security risks? Our Information Security team's mission is to securely enable Trustpilot to be the universal symbol of trust. As our new Governance, Risk and Compliance Analyst, you'll get hands-on with some of our most exciting initiatives yet.

You'll help mature our core compliance frameworks and play a key role in shaping our approach to AI security and governance. From risk-assessing new AI systems to helping us use AI to automate manual GRC workflows, your work will directly strengthen our security posture.

We're an open, inclusive and collaborative team of security enthusiasts who work closely with engineers and data scientists to solve complex problems. If you're a pragmatic technologist who loves balancing risk with fast-paced innovation, we want you to bring your unique perspective and ideas to our team.

You'll partner with our security, risk and engineering teams, to mature our core compliance programs and safely adopt exciting new AI technologies, directly strengthening the trust millions of people place in our platform.

• Drive our ongoing compliance efforts for major industry standards, including SOC 2, ISO27001, ISO42001 and PCI DSS, ensuring we consistently meet commitments to our customers.
• Evaluate and manage the security risks associated with our new artificial intelligence and machine learning systems, allowing our product teams to innovate safely and securely.
• Streamline how we assess the security of our vendors and third-party tools, paying special attention to how we safely integrate external AI technologies into our business.
• Help develop our internal standards for artificial intelligence, keeping us ahead of the curve on new global regulations like the EU AI Act.
• Identify opportunities to replace manual, repetitive risk management tasks with smart, AI-driven automation.
• Refresh our security policies and public-facing documents to clearly communicate our security posture to our customers, partners and auditors.
• Act as an advocate for security awareness across the business, helping colleagues understand how balancing risk and innovation leads to better, safer products.

Who you are:

• You have solid experience managing and auditing against core compliance frameworks, such as SOC 2, ISO27001 and PCI DSS.
• You're well-versed in risk management processes, including risk identification, third-party risk management and vendor security due diligence.
• You have practical experience developing, implementing and managing security policies and procedures.
• You're a pragmatist who knows how to balance security risks with the pace of innovation, bringing a solid understanding of cloud environment risks.
• Bonus points if you're familiar with emerging AI governance frameworks (like the EU AI Act, NIST AI RMF, and ISO/IEC 42001) or have a strong desire to learn them on the job.
• Bonus points if you have experience with, or a keen interest in, using AI to automate manual tasks and drive efficiencies in GRC workflows.

What’s in it for you:

• A range of flexible working options to dedicate time to what matters to you.
• Competitive compensation package + bonus.
• 25 days holiday per year, increasing to 28 days after 2 years of employment.
• Two (paid) volunteering days a year to spend your time giving back to the causes that matter to you and your community.
• Rich learning and development opportunities are supported through the Trustpilot Academy and Blinkist.
• Pension and life insurance.
• Health cash plan, online GP, 24/7, Employee Assistance Plan.
• Full access to Headspace, a popular mindfulness app to promote positive mental health.
• Paid parental leave.
• Season ticket loan and a cycle-to-work scheme.
• Central office location complete with table tennis, a gaming corner, coffee bars and all the snacks and refreshments you can ask for.
• Regular opportunities to connect and get to know your fellow Trusties, including company-wide celebrations and events, ERG activities, and team socials.
• Access to over 4,000 deals and discounts on things like travel, electronics, fashion, fitness, cinema discounts, and more.
• Independent financial advice and free standard professional mortgage broker advice.
• Talent acceleration programs: Fast-track your career with our tailored development programs designed to support growth at whatever stage of your career.

Ready to help us navigate a major shift in technology that brings both exciting opportunities and new security risks? Our Information Security team's mission is to securely enable Trustpilot to be the universal symbol of trust. As our new Governance, Risk and Compliance Analyst, you'll get hands-on with some of our most exciting initiatives yet.

You'll help mature our core compliance frameworks and play a key role in shaping our approach to AI security and governance. From risk-assessing new AI systems to helping us use AI to automate manual GRC workflows, your work will directly strengthen our security posture.

We're an open, inclusive and collaborative team of security enthusiasts who work closely with engineers and data scientists to solve complex problems. If you're a pragmatic technologist who loves balancing risk with fast-paced innovation, we want you to bring your unique perspective and ideas to our team.

You'll partner with our security, risk and engineering teams, to mature our core compliance programs and safely adopt exciting new AI technologies, directly strengthening the trust millions of people place in our platform.

• Drive our ongoing compliance efforts for major industry standards, including SOC 2, ISO27001, ISO42001 and PCI DSS, ensuring we consistently meet commitments to our customers.
• Evaluate and manage the security risks associated with our new artificial intelligence and machine learning systems, allowing our product teams to innovate safely and securely.
• Streamline how we assess the security of our vendors and third-party tools, paying special attention to how we safely integrate external AI technologies into our business.
• Help develop our internal standards for artificial intelligence, keeping us ahead of the curve on new global regulations like the EU AI Act.
• Identify opportunities to replace manual, repetitive risk management tasks with smart, AI-driven automation.
• Refresh our security policies and public-facing documents to clearly communicate our security posture to our customers, partners and auditors.
• Act as an advocate for security awareness across the business, helping colleagues understand how balancing risk and innovation leads to better, safer products.

Who you are:

• You have solid experience managing and auditing against core compliance frameworks, such as SOC 2, ISO27001 and PCI DSS.
• You're well-versed in risk management processes, including risk identification, third-party risk management and vendor security due diligence.
• You have practical experience developing, implementing and managing security policies and procedures.
• You're a pragmatist who knows how to balance security risks with the pace of innovation, bringing a solid understanding of cloud environment risks.
• Bonus points if you're familiar with emerging AI governance frameworks (like the EU AI Act, NIST AI RMF, and ISO/IEC 42001) or have a strong desire to learn them on the job.
• Bonus points if you have experience with, or a keen interest in, using AI to automate manual tasks and drive efficiencies in GRC workflows.

What’s in it for you:

• Rich learning and development opportunities are supported through the Trustpilot Academy and Blinkist
• Pension and life insurance
• Health cash plan, online GP, 24/7 Employee Assistance Plan
• Full access to Headspace, a popular mindfulness app to promote positive mental health
• Paid parental leave
• Season ticket loan and a cycle-to-work scheme
• Central office location complete with all the snacks and refreshments you can ask for
• Regular opportunities to connect and get to know your fellow Trusties, including company-wide celebrations and events, ERG activities, and team socials
• Access to over 4,000 deals and discounts on things like travel, electronics, fashion, fitness, cinema discounts, and more.

Ready to help us navigate a major shift in technology that brings both exciting opportunities and new security risks? Our Information Security team's mission is to securely enable Trustpilot to be the universal symbol of trust. As our new Governance, Risk and Compliance Analyst, you'll get hands-on with some of our most exciting initiatives yet.

You'll help mature our core compliance frameworks and play a key role in shaping our approach to AI security and governance. From risk-assessing new AI systems to helping us use AI to automate manual GRC workflows, your work will directly strengthen our security posture.

We're an open, inclusive and collaborative team of security enthusiasts who work closely with engineers and data scientists to solve complex problems. If you're a pragmatic technologist who loves balancing risk with fast-paced innovation, we want you to bring your unique perspective and ideas to our team.

You'll partner with our security, risk and engineering teams, to mature our core compliance programs and safely adopt exciting new AI technologies, directly strengthening the trust millions of people place in our platform.

• Drive our ongoing compliance efforts for major industry standards, including SOC 2, ISO27001, ISO42001 and PCI DSS, ensuring we consistently meet commitments to our customers.
• Evaluate and manage the security risks associated with our new artificial intelligence and machine learning systems, allowing our product teams to innovate safely and securely.
• Streamline how we assess the security of our vendors and third-party tools, paying special attention to how we safely integrate external AI technologies into our business.
• Help develop our internal standards for artificial intelligence, keeping us ahead of the curve on new global regulations like the EU AI Act.
• Identify opportunities to replace manual, repetitive risk management tasks with smart, AI-driven automation.
• Refresh our security policies and public-facing documents to clearly communicate our security posture to our customers, partners and auditors.
• Act as an advocate for security awareness across the business, helping colleagues understand how balancing risk and innovation leads to better, safer products.

Who you are:

• You have solid experience managing and auditing against core compliance frameworks, such as SOC 2, ISO27001 and PCI DSS.
• You're well-versed in risk management processes, including risk identification, third-party risk management and vendor security due diligence.
• You have practical experience developing, implementing and managing security policies and procedures.
• You're a pragmatist who knows how to balance security risks with the pace of innovation, bringing a solid understanding of cloud environment risks.
• Bonus points if you're familiar with emerging AI governance frameworks (like the EU AI Act, NIST AI RMF, and ISO/IEC 42001) or have a strong desire to learn them on the job.
• Bonus points if you have experience with, or a keen interest in, using AI to automate manual tasks and drive efficiencies in GRC workflows.

What’s in it for you:

• A range of flexible working options to dedicate time to what matters to you
• Competitive compensation package + bonus
• 25 days holiday per year, with an extra 5 days holiday allocated after your 1 year anniversary (prorated) 
• Two (paid) volunteering days a year to spend your time giving back to the causes that matter to you and your community
• Rich learning and development opportunities are supported through the Trustpilot Academy and Blinkist
• Comprehensive health package, pension, and full access to Headspace, a popular mindfulness app to promote positive mental health
• Paid parental leave
• Central office with  a laid-back vibe and constant buzz of different languages being spoken everywhere you go It’s complete with a coffee bar, canteen, and table tennis and has a wide variety of refreshments available - you can opt-in for breakfast and lunch at an affordable price
• Regular opportunities to connect and get to know your fellow Trusties, including company-wide celebrations and events, ERG activities, and team socials
• Opportunity to join the Trustpilot Social Club for a small monthly fee and attend regular social and leisure activities like go-karting, cooking classes, and escape rooms 
• Employee discounts to restaurants and shops