Security Compliance Analyst-UK

Certinia; Harrogate; On-site; GBP 52,000 - 70,000; Full time

Job summary

Certinia is seeking a Security Compliance Analyst to support enterprise-wide security compliance and customer trust initiatives. You will work with IT, Legal, and Privacy to assist audits, governance reviews, and third‑party risk management, reporting to the Head of Information Security.

You will help respond to security questionnaires, maintain approved responses, and assist with customer conversations about security in our products, while aligning with frameworks like ISO 27001, SOC 1/2, and

Qualifications

• 2+ years of information security experience, in particular Governance, Risk & Compliance (GRC) or IT audit background.
• Experience implementing or auditing information security programs based on ISO 27001, SOC 1, SOC 2, FedRAMP, or similar.
• Bachelor’s Degree or equivalent work experience in Computer Science, Engineering, Accounting, or related field.
• Strong written and spoken communication skills, with ability to tailor messages for audiences including legal, IT, security, sales, or customer success.

Responsibilities

• Support Customer Trust program, including security questionnaires and RFx responses.
• Maintain the database of standard responses in Responsive and support the Certinia Proposal Manager as applicable.
• Assist with customer calls to highlight security within products.
• Support audits and readiness initiatives across frameworks such as SOC 1, SOC 2, ISO 27001, ISO 42001, FedRAMP.
• Monitor remediation efforts with stakeholders across geographies and time zones.
• Document gap analysis in work programs and track remediation progress.
• Support the creation, review, and maintenance of information security policies, standards, procedures, and guidelines.
• Maintain enterprise-wide security controls library and map controls to frameworks.
• Works with Legal to support security language aligned to the company's commitments.
• Performs third-party security risk assessments for scheduled annual assessments and onboarding of new vendors.
• Maintains inventory of vendors for risk management within Whistic, ensuring up-to-date information and audit-ready documentation.
• Supports and tracks remediation required for any non-compliance issues identified.

Skills

GRC experience

Customer-facing communication

Written communication

Global teams across time zones

Education

Bachelor’s Degree or equivalent in CS/Engineering/Accounting

Tools

ISO 27001

SOC 1

SOC 2

FedRAMP

CSA CAIQ / VSA / SIG Lite

Job description

Security Compliance Analyst
Location: UK

WHO WE ARE

Certinia delivers a Services-as-a-Business platform that powers and connects all aspects of services operations, from services estimation and delivery to customer success management and financial planning and accounting. The company’s Professional Services Automation (PSA), Customer Success (CS), and Financial Management (FM) solutions—delivered on Salesforce’s leading cloud platform—provide the ability to run a connected services business, deliver with intelligence, and achieve business agility. Headquartered in Austin, Texas with presence around the world, Certinia is backed by Haveli Investments, TA Associates, General Atlantic and Salesforce Ventures. For more information, visit www.certinia.com.

THE ROLE

The Security Compliance Analyst will be responsible for supporting security compliance and customer trust enterprise-wide. The individual will support various functions, including customer response, compliance audits, governance review, controls monitoring, third-party risk management, contractual reviews, and other support as needed for the Information Security team. This role will work closely with the Security Compliance Manager and will partner with functions such as IT, Legal, and Privacy. This role will report to the Certinia Head of Information Security.

WHAT YOU WILL DO IN THIS ROLE

• Assists with the Customer Trust Program, including the completion of customer security questionnaires and actively supporting sales proposals and RFx’s.
• Maintains the database of standard responses in Responsive and supports the Certinia Proposal Manager as applicable.
• Supports calls with customers to highlight security within products.
• Supports compliance audits and readiness initiatives (driven by frameworks such as SOC 1, SOC 2, ISO 27001, ISO 42001, FedRAMP).
• Monitors control remediation efforts with stakeholders across various functions in different geographies & time zones.
• Document gap analysis in work programs and record progress on remediation plans.
• Supports the creation, review, and maintenance of information security policies, standards, procedures, and guidelines.
• Maintains enterprise-wide security controls library, cross-maps across various control frameworks, and identifies controls relevant to Certinia.
• Works with Legal to support security language review strictly aligned to the company's security commitments.
• Performs standard third-party security risk assessments for both scheduled annual assessments and for the onboarding of new vendors.
• Maintains inventory of vendors for risk management within Whistic, ensuring up-to-date information, current key contacts, accurate scoping, and sufficient documentation for audit purposes.
• Supports and tracks remediation required for any non-compliance issues identified.

WHAT YOU NEED TO BE SUCCESSFUL IN THIS ROLE

• 2+ years of information security experience, in particular Governance, Risk & Compliance (GRC) or with an IT audit background.
• Experience implementing or auditing information security programs based on industry frameworks such as ISO 27001, SOC 1, SOC 2, FedRAMP, or similar.
• Bachelor’s Degree or equivalent work experience in Computer Science, Engineering, Accounting, or related field required.
• Strong, customer-facing communication skills, with expertise in breaking down complex concepts into digestible information.
• Strong written skills, with an attention to detail for the significance of how things can be best phrased and tailored to various audiences, including end users, legal, IT, security, sales, or customer success.
• A customer-obsessed mindset, able to understand how security contributes to sales enablement.
• Experience working on global teams across time zones, cultures, and languages.

WHAT IS ALSO HIGHLY DESIRABLE

• Familiarity with the Salesforce platform and shared security responsibility models in SaaS environments.
• Relevant certifications such as CISSP, CISM, CRISC, or CISA.
• Working knowledge of CSA CAIQ, VSA, SIG Lite, and other industry-standard questionnaires.
• Working experience with SaaS solutions such as Responsive, Whistic, and various GRC platforms.