SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 75,600 - 118,800 / annual
Hi Marley is an AI-powered software company transforming property & casualty (P&C) insurance claims communication. This Security Trust & Compliance Analyst role is an individual contributor position reporting to the Director of Security, designed for someone with hands-on compliance and security assurance experience ready to own a significant portion of the company's customer trust and audit functions.
You will be the primary point of contact for customers and auditors seeking answers about Hi Marley's data protection, security controls, and compliance posture. Your responsibilities span five core areas:
**Product & Operations Knowledge:** Learn how Hi Marley builds and ships software, manages AWS infrastructure, implements AI features, and operates its control environment. Develop working relationships with Product, Engineering, DevOps, and Security teams so you can accurately explain the company's practices to customers' security, privacy, and compliance teams.
**Customer Trust & Due Diligence:** Own carrier security reviews of Hi Marley, including security questionnaires (SIG, CAIQ, custom), third-party risk assessments, and follow-up requests for new deals and renewals. Support Sales on security sections of RFPs. Maintain an accurate answer library and escalate novel commitments, contract language, or control gaps to Security and Legal for review.
**AI Governance & AI Due Diligence:** Answer carrier questions about Hi Marley's use of AI, including which features rely on it, which third-party providers process data, how models are monitored and updated, and how customer data is handled. Help build and maintain evidence for the company's AI governance program, aligned to ISO/IEC 42001 or NIST AI RMF standards.
**Audit Support & Evidence Management:** Serve as the day-to-day contact for SOC 2 Type II and ISO auditors. Plan evidence requests, collect and organize evidence from control owners, interpret auditor requests and findings, and track remediation to closure.
**Policy & Control Development:** Help maintain information security, privacy, and AI policies to withstand SOC 2 examinations and ISO/IEC 42001 audits while meeting carrier expectations. Draft practical standards and guidelines for Security leadership approval. Identify gaps between documented and actual practices and work with control owners to close them.
**Requirements:**
- 3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance, ideally at a B2B SaaS company
- Hands-on experience completing security questionnaires (SIG, CAIQ, and custom customer questionnaires) and security sections of RFPs
- Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs
- Knowledge of ISO/IEC 27001 or equivalent information security frameworks
- Familiarity with AI governance frameworks (ISO/IEC 42001, NIST AI RMF, or similar) is a plus
- Relevant certifications such as CISA, CISSP, CISM, or CRISC are preferred
