Security & Privacy Analyst

Credo Screening; United States; Remote; USD 90,000 - 140,000; Full time

Benefits offered by this job

Competitive salary + equity

Unlimited PTO

Remote-first culture

Home office stipend

Company offsites

Job summary

Credo Screening is seeking a Security & Privacy Analyst to build and operationalize its security and privacy compliance programs from the ground up. This hands-on role involves defining policies, building processes, and engaging with customers to demonstrate data handling with the highest standards.

You'll own SOC 2, GDPR/CCPA, and privacy-by-design, work with engineering on secure development, and coordinate audits with external testers and auditors. Remote-first, US/Canada.

Qualifications

• 3–6 years in security, privacy, compliance, or risk management.
• Experience building or contributing to SOC 2, ISO 27001, or similar programs.
• Familiarity with GDPR, CCPA/CPRA, biometric data laws (BIPA or similar).
• Understanding of cloud security fundamentals across major providers.
• Experience completing security questionnaires for enterprise customers.
• Ability to work cross-functionally with engineering, legal, and leadership.
• Strong documentation skills and policy-writing ability.

Responsibilities

• Build and maintain Credo's security and privacy programs (SOC 2, GDPR, CCPA/CPRA).
• Implement and monitor security controls across infrastructure, apps, and data.
• Lead security and privacy audits, assessments, and certifications.
• Own customer security questionnaires, vendor assessments, and due diligence reviews.
• Define data handling policies for biometric data, government IDs, and PII.
• Collaborate with engineering on secure development—encryption, access controls, key management, data retention.
• Manage biometric data lifecycle with encryption during verification and deletion when complete.
• Identify risks and drive remediation across the platform.
• Develop security documentation—policies, procedures, IR plans, DPA.
• Support customer inquiries about our security posture; monitor privacy laws.
• Coordinate with auditors, pen-testers, and security vendors.

Skills

SOC 2

ISO 27001

privacy compliance

risk management

privacy regs (GDPR/CCPA/CPRA)

cloud security

security questionnaires

cross-functional collaboration

documentation

Tools

GCP

AWS

Azure

Job description

Build and operationalize our security and privacy compliance programs from the ground up.

We're looking for a Security & Privacy Analyst to build and operationalize our security and privacy compliance programs from the ground up.

This is a hands‑on role at an early‑stage company. You won't just maintain compliance check‑lists — you'll define the policies, build the processes, and work directly with customers who need assurance that their data is handled with the highest standard of care. If you want to own a security program rather than just support one, this is the role.

What you'll do

• Build and maintain Credo's security and privacy compliance programs (SOC 2, GDPR, CCPA/CPRA)
• Implement and monitor security controls across infrastructure, application, and data handling processes
• Lead security and privacy audits, assessments, and certification efforts
• Own customer security questionnaires, vendor assessments, and due diligence reviews — partnering with sales to unblock enterprise deals
• Define and enforce data handling policies for sensitive data: biometric data, government ID images, screening results, and PII
• Partner with engineering to ensure secure development practices — encryption, access controls, key management, and data retention
• Manage the biometric data lifecycle — ensuring data is encrypted during verification and deleted immediately after
• Identify privacy and security risks across the platform and drive remediation
• Develop and maintain security documentation: policies, procedures, incident response plans, and data processing agreements
• Support customer compliance inquiries — regulated customers will need detailed answers about our security posture
• Monitor regulatory changes in data privacy, biometric data laws, and AML/KYC requirements
• Manage relationships with external auditors, penetration testers, and security vendors

What you'll bring

• 3–6 years of experience in security, privacy, compliance, or risk management
• Experience building or contributing to SOC 2, ISO 27001, or similar compliance programs
• Familiarity with privacy regulations: GDPR, CCPA/CPRA, BIPA, or other biometric data laws
• Understanding of cloud security fundamentals (GCP, AWS, or Azure)
• Experience completing security questionnaires and supporting enterprise sales cycles
• Strong ability to work cross‑functionally with engineering, legal, and leadership
• Excellent documentation skills — you can write clear policies, not just check boxes
• Comfortable operating with autonomy in a fast‑paced, early‑stage environment

Nice to have

• Experience at a company handling biometric data, identity verification, or background screening
• Familiarity with AML/KYC compliance requirements and how they affect data handling
• CIPP, CISSP, CISA, or similar certifications
• Experience with GCP security tooling (Cloud Armor, IAM, Security Command Center)
• Previous early‑stage startup experience — you've built a compliance program from scratch
• Experience with penetration testing coordination and vulnerability management

Own the program

You'll define and build Credo's security and privacy program from the ground up.

We handle government IDs, biometrics, and sanctions data. The security work here is real and meaningful.

Customer‑facing influence

Your work directly enables enterprise sales. When a bank asks "are you SOC 2 compliant?", your work is the answer.

Growing market

AML/KYC compliance is mandatory for regulated industries. As our customer base grows, so does the importance of this role.

Remote‑first

Work from anywhere in the US or Canada.

• Competitive salary + equity
• Unlimited PTO
• Remote‑first culture
• Home office stipend
• Company offsites