Lead Security Compliance Analyst, (f/m/d)

Personio GmbH; Berlin; Vor Ort; EUR 90.000 - 130.000; Vollzeit

Benefits dieser Stelle

20 Flex Days per year

Hybrid work arrangement

28 days vacation

Zusammenfassung

Personio GmbH in Berlin is seeking a Lead Security Compliance Analyst to own risk management and drive internal IT audits within our security organization. You will coordinate with Engineering, Legal, and IT to maintain and expand ISO 27001/27017 certifications and prepare for SOC attestations.

In this hands-on role, you will manage risk registers, guide audit evidence collection, and leverage AI tools to streamline GRC tasks while communicating clearly with technical and non-technical

Qualifikationen

• 3–5 years of experience in a GRC, information security, or IT risk role.
• Hands-on familiarity with ISO 27001 and at least one other framework (e.g. SOC 2, NIST).
• Experience supporting audits, managing evidence, and working with control requirements.
• Strong stakeholder management skills across technical and non-technical audiences.
• Comfort with AI and LLM tooling to scale GRC work.

Aufgaben

• Lead technical risk management, maintaining the risk register and driving remediation.
• Drive internal IT audit activity, drafting audit plans and tracking findings.
• Support and improve the Information Security Management System aligned with ISO 27001:2022 and ISO 27017:2015.
• Coordinate evidence collection and interface with external auditors for new attestations (SOC 1, SOC 2).
• Produce regular risk snapshots and audit status updates for engineers, leaders, and stakeholders.

Kenntnisse

GRC experience

Information security

Audit experience

ISO 27001

Stakeholder management

AI / LLM tooling

English communication

Jobbeschreibung

Lead Security Compliance Analyst, (f/m/d)

Personio's intelligent HR platform helps small and medium-sized organizations unlock the power of people by making complicated, time-consuming tasks simple and efficient. Our team of 1,500 Personios is building user-friendly products that delight our 15,000+ customers and their 1.5 million employees. Ready to make an impact from day one?

The Role:

This role is based in Berlin.

Join us to shape the future of software in the underserved and high-impact HR technology industry. Your work will have a direct and tangible impact on customers, offering ownership and the chance to make a meaningful difference. As we prepare for significant growth, you’ll face exciting challenges and have the opportunity to influence our path toward becoming one of the world’s leading tech companies.

Security is a first-class priority at Personio. As a Lead Security Compliance Analyst, you will be a key contributor within our Security organisation, supporting and extending the work with our Security Compliance Manager to protect the trust our customers and partners place in us. You will lead our our technical risk management program, drive internal IT audit activity and support our external audits, and play a hands-on role in maintaining our current certifications - BSI C5, ISO 27001, and ISO 27017 - while helping to expand our compliance portfolio with new attestations such as SOC 1 and SOC 2. You will work cross-functionally across Engineering, IT, Legal, and HR, translating complex compliance and risk requirements into clear, actionable programs that scale with Personio’s growth.

What You\'ll Do:

• Lead technical risk management - maintain and evolve the technical risk register, facilitate recurring risk review cycles with risk owners, and drive risk remediation using Hyperproof as the primary GRC platform.
• Drive internal IT audit activity - draft and conduct internal audit plans, manage findings through to resolution, and maintain a repository of audit evidence and corrective action plans.
• Partner with our Security Compliance Manager - support and continuously improve Personio’s Information Security Management System, aligned with ISO/IEC 27001:2022 and ISO/ICE 27017:2015. You will contribute to achieving new attestations (e.g. SOC 1, SOC 2) by coordinating evidence collection, managing control gaps, and interfacing with external auditors.
• Drive compliance reporting - produce regular risk snapshots and audit status updates tailored for a range of stakeholders, from engineering teams to senior leadership, ensuring transparency across the organization.
• Coordinate with stakeholders across the business - partner with teams in Engineering, IT, Legal, and HR to identify control gaps, support audit readiness, and ensure compliance documentation (policies, ISMS, SoA) is current and accurate.
• Apply AI and modern tooling to scale GRC work - leverage LLMs and automation to accelerate tasks such as cross-standard control mapping, evidence correlation, and compliance gap analysis.

What You Need To Succeed:

• 3–5 years of experience in a GRC, information security, or IT risk role, with demonstrated ownership of risk management processes - including risk identification, classification, and driving remediation with risk owners.
• Hands-on familiarity with ISO 27001 and at least one other recognized framework (e.g. SOC 2, NIST) - including practical experience supporting audits, managing evidence, and working with control requirements. Additional nice to haves are experience with German frameworks, e.g. TISAX and BSI C5.
• Audit experience - able to independently draft and execute internal audit plans, document findings, and track corrective actions through to closure.
• Strong stakeholder management skills - comfortable presenting GRC work to both technical and non-technical audiences, coordinating across multiple teams, and driving compliance activities without direct authority.
• Comfort with AI and LLM tooling - experience using language models to support compliance work (e.g. mapping controls across frameworks, drafting policies, summarizing audit findings) and an appetite to expand this capability.
• Clear written and verbal communication in English - able to translate compliance and risk concepts into clear reporting and documentation for a wide range of stakeholders.

Why Personio?

Personio is an equal opportunities employer, committed to building an integrative culture where everyone feels welcomed and supported. We embrace uniqueness and understand that our diverse, values-driven culture makes us stronger. We are proud to have an inclusive workplace environment that will foster your development no matter your gender, civil status, family status, sexual orientation, religion, age, disability, education level, or race.

At Personio, we value in-person collaboration while also offering flexibility. This role is office-based, with 2 days per month required in your contracted office location. The remaining days can be worked from home or in the office if you prefer. In addition, you’ll have 20 Flex Days per year to work remotely from other locations. Aside from our people, culture, and mission, check out some of the other benefits that make Personio a great place to work:

• Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity
• Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years
• Make an impact on the environment and society with 1 (fully paid) Impact Day
• Receive generous family leave, child support, mental health support, and sabbatical opportunities
• We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There\'s also healthy snacks, drinks, and a weekly catered lunch.