Senior GRC Analyst — SOC 2 & AI-Driven Compliance

Preply; Barcelona; On-site; EUR 90,000 - 130,000; Full time

Benefits offered by this job

Relocation package to Barcelona hub

Health insurance

Learning & Development budget

Lessons on Preply.com monthly

Mental health support platforms

Gym access across Spain

Job summary

Preply is seeking a Senior GRC Analyst to join the Cybersecurity team and advance our governance, risk, and compliance program. You will lead risk assessments, manage third-party risk, and help drive SOC 2 Type 2 readiness while aligning with ISO 27001 and privacy regulations across a global business.

You will collaborate with Legal, Engineering, Security, Product, and Finance to embed governance into day-to-day operations and explore AI-driven automation for evidence collection and reporting.

Qualifications

• 5+ years in GRC, risk management, compliance, or cybersecurity - preferably in a tech or SaaS environment.
• Hybrid profiles (e.g., lawyers with CISSP, or engineers with compliance experience).
• A proven track record in: SOC 2 implementation (must-have).
• Experience with frameworks/standards such as ISO 27001, ISO 27701, PCI DSS, or similar
• Experience with regulations such as GDPR, CCPA, COPPA, EU AI Act, or similar.
• Risk assessments and KRIs.
• Cross-functional collaboration and stakeholder management.
• Core Competencies Strong understanding of cloud security and modern SaaS risk landscapes.
• Ability to translate regulatory requirements into practical, business-friendly policies.
• Effective communicator with experience in running cross-functional sessions.
• Practical experience applying AI tools in day-to-day work.
• Experience with GRC/compliance automation tooling is a plus.
• Certifications (nice to have, not required): CISA, CISM, CISSP, CRISC, ISO 27001 Lead Auditor, CIPM.

Responsibilities

• Maintain and continuously improve the risk management framework.
• Manage and continuously improve Preply's risk management framework, defining risk management approaches and overseeing the implementation of mitigation actions across the business.
• Lead risk assessments.
• Run enterprise risk assessments, surfacing both technical and non-technical risks, and track Key Risk Indicators (KRIs) and other data-driven risk metrics to report to leadership.
• Manage third-party risk.
• Maintain a third-party risk management program and perform periodic vendor reviews to ensure suppliers meet Preply's security bar.
• Help shape governance and policy.
• Participate in developing and maintaining security, AI, and compliance policies in collaboration with Legal, Security, and Data teams, embedding governance checks into everyday business operations.
• Drive SOC 2 and beyond.
• Support compliance initiatives for SOC 2 Type 2, with potential expansion to ISO 27001, ensuring controls are documented, tested, and audit-ready.
• Support privacy initiatives.
• Contribute to data retention policies and guidelines for how different departments handle personal data.
• Be the cross-functional bridge.
• Support coordination between Cybersecurity, Legal, and Engineering - translating regulatory requirements (GDPR, CCPA, etc.) into actionable policies, and supporting internal/external audits, policy reviews, and compliance syncs.
• Champion security culture.
• Drive security awareness and compliance culture across the company.
• Automate GRC operations.
• Identify opportunities to use AI tools to automate and streamline risk and compliance workflows (e.g. evidence collection, control monitoring, reporting).

Skills

GRC

risk management

compliance

cybersecurity

SOC 2

ISO 27001

privacy

regulatory frameworks

cross-functional collaboration

AI tools

GRC automation

certifications

Job description

Preply is seeking a Senior GRC Analyst to join the Cybersecurity team and advance our governance, risk, and compliance program. You will lead risk assessments, manage third-party risk, and help drive SOC 2 Type 2 readiness while aligning with ISO 27001 and privacy regulations across a global business.

You will collaborate with Legal, Engineering, Security, Product, and Finance to embed governance into day-to-day operations and explore AI-driven automation for evidence collection and reporting.