Security Compliance Analyst-UK

Security Compliance Analyst

Location: UK

Who We Are

Certinia delivers a Services-as-a-Business platform that powers and connects all aspects of services operations, from services estimation and delivery to customer success management and financial planning and accounting. The company’s Professional Services Automation (PSA), Customer Success (CS), and Financial Management (FM) solutions—delivered on Salesforce’s leading cloud platform—provide the ability to run a connected services business, deliver with intelligence, and achieve business agility. Headquartered in Austin, Texas with presence around the world, Certinia is backed by Haveli Investments, TA Associates, General Atlantic and Salesforce Ventures. For more information, visit www.certinia.com.

THE ROLE

The Security Compliance Analyst will be responsible for supporting security compliance and customer trust enterprise-wide. The individual will support various functions, including customer response, compliance audits, governance review, controls monitoring, third-party risk management, contractual reviews, and other support as needed for the Information Security team. This role will work closely with the Security Compliance Manager and will partner with functions such as IT, Legal, and Privacy. This role will report to the Certinia Head of Information Security.

What You Will Do In This Role

• Assists with the Customer Trust Program, including the completion of customer security questionnaires and actively supporting sales proposals and RFx’s.
• Maintains the database of standard responses in Responsive and supports the Certinia Proposal Manager as applicable.
• Supports calls with customers to highlight security within products.
• Supports compliance audits and readiness initiatives (driven by frameworks such as SOC 1, SOC 2, ISO 27001, ISO 42001, FedRAMP).
• Monitors control remediation efforts with stakeholders across various functions in different geographies & time zones.
• Document gap analysis in work programs and record progress on remediation plans.
• Supports the creation, review, and maintenance of information security policies, standards, procedures, and guidelines.
• Maintains enterprise-wide security controls library, cross-maps across various control frameworks, and identifies controls relevant to Certinia.
• Works with Legal to support security language review strictly aligned to the company's security commitments.
• Performs standard third-party security risk assessments for both scheduled annual assessments and for the onboarding of new vendors.
• Maintains inventory of vendors for risk management within Whistic, ensuring up-to-date information, current key contacts, accurate scoping, and sufficient documentation for audit purposes.
• Supports and tracks remediation required for any non-compliance issues identified.

What You Need To Be Successful In This Role

• 2+ years of information security experience, in particular Governance, Risk & Compliance (GRC) or with an IT audit background.
• Experience implementing or auditing information security programs based on industry frameworks such as ISO 27001, SOC 1, SOC 2, FedRAMP, or similar.
• Bachelor’s Degree or equivalent work experience in Computer Science, Engineering, Accounting, or related field required.
• Strong, customer-facing communication skills, with expertise in breaking down complex concepts into digestible information.
• Strong written skills, with an attention to detail for the significance of how things can be best phrased and tailored to various audiences, including end users, legal, IT, security, sales, or customer success.
• A customer-obsessed mindset, able to understand how security contributes to sales enablement.
• Experience working on global teams across time zones, cultures, and languages.

What Is Also Highly Desirable

• Familiarity with the Salesforce platform and shared security responsibility models in SaaS environments.
• Relevant certifications such as CISSP, CISM, CRISC, or CISA.
• Working knowledge of CSA CAIQ, VSA, SIG Lite, and other industry-standard questionnaires.
• Working experience with SaaS solutions such as Responsive, Whistic, and various GRC platforms.