Security Trust & Compliance Analyst

Hi Marley; Boston (MA); On-site; USD 110,000 - 160,000; Full time

Job summary

Hi Marley is seeking a Security Trust & Compliance Analyst to own customer security reviews, respond to questionnaires and RFPs, and coordinate with auditors on SOC 2 Type II and ISO 27001 evidence. You will work across product, engineering, and legal to keep controls aligned with market expectations.

You will document AI governance and due diligence evidence, maintain our evidence library, and help ensure privacy and data protection across SaaS operations for insurers and customers.

Qualifications

• ISO/IEC 27001 knowledge, structure and audit experience.
• Experience with security questionnaires and RFPs.
• 3–5 years in security compliance, GRC, IT audit, or customer security assurance.
• Ability to discuss AWS, IAM, encryption, and SDLC with engineers.

Responsibilities

• Own carrier security reviews including questionnaires and third-party risk assessments.
• Support Sales on security sections of RFPs.
• Keep answer library accurate and current; escalate novel commitments for review.
• Help build and maintain AI governance and related evidence.
• Be day-to-day contact for SOC 2 Type II and ISO auditors; plan evidence requests.
• Draft and maintain information security, privacy, and AI policies; close gaps with control owners.

Skills

ISO/IEC 27001 knowledge

Cross-functional coordination

Security questionnaires

Security compliance experience

Cloud security fundamentals

SOC 2 support

Technical writing

Regulated industry experience

AI governance frameworks

Risk/trust center familiarity

Privacy laws familiarity

AI drafting assistance

Certifications (CISA/CISSP/CISM/CRISC)

Tools

Vanta

Drata

SafeBase

Loopio

Conveyor

Job description

• We are looking for a Security Trust & Compliance Analyst to be the person our customers and auditors rely on for accurate answers about how Hi Marley protects their data
• You will learn our products and how we run them, answer security questionnaires, RFPs and due-diligence requests from insurance carriers, work with our auditors on SOC 2 and ISO evidence, and help keep our policies in step with what the market expects
• This is an individual contributor role, reporting to the Director, Security, for someone who has done this work before and is ready to own a large share of it
• Product & Operations Knowledge: Learn how Hi Marley builds and ships software, runs AWS infrastructure, implements AI features, and operates its control environment, well enough to explain each accurately to our customers’ security, privacy, and compliance teams. Build working relationships with Product, Engineering, DevOps, and Security so you know whom to ask and notice when an answer has changed
• Customer Trust & Due Diligence: Own carrier security reviews of Hi Marley, including questionnaires, third-party risk assessments, and follow-up requests, for new deals and renewals. Support Sales on the security sections of RFPs. Keep our answer library accurate and current and bring anything novel, such as new commitments, contract language, or control gaps, to Security and Legal for review
• AI Governance & AI Due Diligence: Answer carrier questions about how Hi Marley uses AI, including which features rely on it, which third-party providers process data, how models are monitored and changed, and how customer data is handled throughout. Help build and maintain the evidence behind our AI governance program, aligned to ISO/IEC 42001 or the NIST AI RMF
• Audit Support & Evidence Management: Be the day-to-day contact for our SOC 2 Type II and ISO auditors. Plan evidence requests, collect and organize evidence from control owners, interpret auditor requests and findings for the teams involved, and track remediation to closure
• Policy & Control Development: Help maintain our information security, privacy, and AI policies so they hold up in SOC 2 examinations and ISO/IEC 42001 audits and match what carriers expect in contracts and questionnaires. Draft practical standards and guidelines, for Security leadership approval, that internal teams can follow day to day. Spot where documented practice and actual practice differ, and work with control owners to close the gap

Benefits

• Core values-based leadership
• A fun, lively startup culture
• Open vacation policy - we all work hard and take time for ourselves when we need it
• Ample opportunities to learn and take on new responsibilities in a fast-paced, growth-mode startup
• A culture of employee engagement, diversity and inclusion
• Full benefits package including parental leave, a matching 401k program, and medical, dental, vision, disability, and life insurance
• Generous stock options - we all get to own a piece of what we’re building

• Working knowledge of ISO/IEC 27001 or another management system standard, including how it is structured and audited
• Organized and comfortable running many requests against deadlines, working across Sales, Legal, Product, and Engineering
• Hands-on experience completing security questionnaires (SIG, CAIQ, and custom customer questionnaires) and the security sections of RFPs3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance, ideally at a B2B SaaS company
• Enough technical understanding of cloud infrastructure (AWS), identity and access management, encryption, and the software development lifecycle to discuss them with engineers and explain them to non-technical readers
• Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs
• Clear, precise writing. You can describe a control in plain language without overstating it
• Experience in insurance, financial services, or another regulated industry, including familiarity with NY DFS Part 500, the NAIC Insurance Data Security Model Law, or the NAIC Model Bulletin on the use of AI by insurers
• Exposure to ISO/IEC 42001, the NIST AI Risk Management Framework, or other AI governance frameworks
• Experience maintaining a risk register or a customer-facing trust center (e.g., Vanta, Drata, SafeBase, Loopio, Conveyor)
• Familiarity with privacy requirements and data processing agreements (e.g., CCPA/CPRA, PIPEDA)
• Experience using AI tools to draft, check, and maintain questionnaire responses
• Relevant certifications, such as CISA, CISSP, CISM, or CRISC