Compliance Trust Analyst

Overview

Trust Analyst II on Abnormal's Compliance Trust team, owning the company's governance and policy program and supporting risk management operations and general compliance activities.

What you'll do

• Own and run Abnormal's governance committees, including AI Governance, Data Governance, Security Governance, and any additional governance programs the business needs.
• Set committee agendas, facilitate cross-functional stakeholders, and drive decisions to closure.
• Hold end-to-end ownership of the policy program, including drafting, revising, and maintaining policies across governance domains, and driving stakeholder review and acknowledgment.
• Manage the company's Policy Center, which hosts all enterprise policies.
• Own risk management operations, including the risk register, risk assessments, and administration of risk exceptions, enforcing the 12-month exception cap with mandatory renewal review and required documentation.
• Keep abreast of regulatory and industry developments and advise leadership on their potential impact on the program strategy and plans.
• Ensure program activities align with strategy and manage the timely and high-quality execution of GRC milestones.
• Drive internal control effectiveness through control monitoring, control enhancements, and thought leadership on control design, operations, and supporting processes and policies.
• Perform compliance readiness assessments and provide updates, recommendations, and roadmaps to senior management within Security and to business partners.
• Advise, educate, and train process and control owners on preparing and maintaining controls and control documentation (policies, procedures, narratives, and matrices).
• Recommend, develop, and manage the company's risk register, including defining and reporting on key risk indicators (KRIs) and key performance indicators (KPIs).
• Conduct regular risk assessments and work with relevant departments to identify, evaluate, and mitigate risks across the organization.
• Advise, educate, and train risk owners on identification, assessment, mitigation, and monitoring of risks.
• Proactively identify gaps or conflicts in existing policies and processes and develop solutions with internal business partners.
• Drive remediation and risk mitigation activities, including root cause analysis and owning the design, tracking, and progress of action plans.
• Track risk trends across cycles and flag recurring patterns before they become repeat findings.
• Design and manage program operations, and implement and maintain technology to support the program.
• Engage in ad-hoc projects as required.
• Maintain regular, clear communication with project teams, key partners, and management on controls testing, audit progress, risk assessment progress, and issues management.
• Communicate program and project execution status, program health, key accomplishments, and risks to senior management within Security and to business partners.

What you'll need

• Proven security experience in an audit or advisory capacity.
• 4-7 years of experience in cyber security, technology risk, GRC, and/or technical compliance roles, with at least 2 years focused on ISO 27001 implementation and maintenance.
• Demonstrated experience leading at least one full ISO 27001 certification cycle (including the 2022 revision of ISO 27001) from start to finish.
• Proven project management experience, including managing multiple concurrent compliance projects with competing deadlines; leading cross-functional teams across technical and business units; experience with project management methodologies (Agile, Waterfall) and tools (ServiceNow, etc.); and a track record of delivering complex compliance projects on time and within scope.
• Experience owning or facilitating cross-functional governance programs or committees (e.g., AI governance, data governance, security governance), including running working groups and driving decisions with senior stakeholders.
• Strong understanding of security concepts and practical usage, including Information Security Management System (ISMS) implementation and maintenance, control mapping across multiple frameworks, and continuous control monitoring and automation.
• Experience implementing and managing compliance programs aligned with ISO 27001 and ISO 27701, including development and maintenance of Statement of Applicability, risk treatment plans and risk acceptance criteria, internal audit programs, and management review processes.
• Proven track record working with external auditors, including internal stakeholder management.
• Experience with audit automation and continuous control monitoring tools.
• Proven ability to manage multiple stakeholders and vendors while maintaining project momentum.
• Analytical thinking and good business judgment; able to resolve ambiguous or judgment-call questions without direction.
• Attention to detail, strong process and organizational skills, and a self-motivated, collaborative work style.

Nice to have

• Bachelor's degree or equivalent military experience.
• ISO 27001, 27701, or 42001 Lead Auditor Certification.
• CRISC, CISSP, CPA, CISA, PMP, CISM certification(s).
• Experience with NIST CSF, NIST SP 800-53 / 171, or other control frameworks.
• Familiarity with AI governance frameworks (e.g., ISO/IEC 42001, NIST AI RMF).
• Experience preferably at a technology or SaaS / Cloud company and/or with a regulated public company.
• 2+ years of Big 4 experience.

Details

• Location: Remote, USA.
• Base salary range: $114,800 – $165,000 USD; may also be eligible for bonus or incentive compensation, equity, and benefits.
• Pre-employment checks apply to any conditional offer.