SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Optimizely is seeking an experienced Senior Compliance and Risk Analyst to join its global Compliance function in Berlin. This is a high-impact individual contributor role (IC3 level) with broad scope spanning information security certification, PCI DSS compliance, data privacy, and environmental, social, and governance (ESG) programmes.
The role will serve as a key compliance resource for the Campaign product line, which holds its own ISO 27001 certification scope, while contributing to Optimizely's global PCI DSS v4.0.1 programme. The analyst will also oversee and drive the company's companywide ESG programme—a growing area of strategic importance as customers, investors, and regulators increasingly expect demonstrable sustainability and responsible business commitments.
Key responsibilities include:
**Campaign ISO 27001 (15%):** Support and co-maintain the ISO 27001 Information Security Management System (ISMS) for Campaign, including scope definition, risk treatment, and Statement of Applicability. Act as a supporting contact for the Campaign ISMS, collaborating with product, engineering, infrastructure, and Compliance teams. Assist in preparing and managing annual ISO 27001 surveillance and recertification audits, conduct scheduled internal audits and management reviews, and maintain the Campaign scope risk register.
**PCI DSS v4.0.1 (25%):** Support and co-maintain Optimizely's global PCI DSS v4.0.1 compliance program. Maintain an accurate Cardholder Data Environment (CDE) scope, coordinate the annual AOC/SAQ-D process, manage the Qualified Security Assessor (QSA) relationship, and track remediation of PCI DSS findings.
**ESG Programme (50%):** Define and execute Optimizely's companywide ESG strategy, roadmap, and reporting framework. Develop and maintain ESG disclosure frameworks, coordinate ESG data collection across the business, prepare and publish annual ESG reports, respond to customer ESG questionnaires and rating agency requests, and build an ESG roadmap identifying gaps against emerging requirements.
**GDPR and Data Privacy (10%):** Support Optimizely's global data privacy programme, maintaining compliance with GDPR, CCPA, and global privacy laws. Assist with operational privacy tasks including DPIAs, vendor privacy assessments, and DPA workflows.
This is an individual contributor role operating with high autonomy and deep subject matter expertise, influencing outcomes across product, engineering, legal, and commercial teams without direct line management authority. The successful candidate will report to the Director of Compliance.
