Security Trust & Compliance Analyst

Hi Marley

. Learn how Hi Marley builds and ships software, runs AWS infrastructure, implements AI features, and operates its control environment .

Posted 10/15/2026full-timeBoston • Massachusetts • United StatesMid-LevelSenior💰 $75,600 - $118,800 per yearWebsite

Tech Stack

Tools & technologies

AWS

About the role

Key responsibilities & impact

Learn how Hi Marley builds and ships software, runs AWS infrastructure, implements AI features, and operates its control environment
Build relationships with Product, Engineering, DevOps, and Security to maintain accurate customer-facing information
Own carrier security reviews, including questionnaires, third-party risk assessments, and follow-up requests for new deals and renewals
Support Sales with security sections of RFPs
Maintain the security questionnaire answer library and escalate novel commitments, contract language, or control gaps to Security and Legal
Answer carrier questions about AI features, third-party data processors, model monitoring and changes, and customer data handling
Help build and maintain evidence for the AI governance program aligned with ISO/IEC 42001 or NIST AI RMF
Serve as day-to-day contact for SOC 2 Type II and ISO auditors
Plan evidence requests, collect and organize control evidence, interpret auditor requests and findings, and track remediation to closure
Maintain information security, privacy, and AI policies
Draft practical standards and guidelines for Security leadership approval
Identify gaps between documented and actual practices and work with control owners to close them

Requirements

What you’ll need

3–5 years of experience in security compliance, GRC, IT audit, or customer security assurance, ideally at a B2B SaaS company
Hands-on experience completing security questionnaires, including SIG, CAIQ, and custom customer questionnaires
Experience completing security sections of RFPs
Direct experience supporting a SOC 2 Type II examination, including evidence collection and auditor walkthroughs
Working knowledge of ISO/IEC 27001 or another management system standard, including how it is structured and audited
Technical understanding of AWS, identity and access management, encryption, and the software development lifecycle
Clear, precise writing and ability to describe controls in plain language
Ability to manage many requests against deadlines across Sales, Legal, Product, and Engineering
Nice-to-have: experience in insurance, financial services, or another regulated industry
Nice-to-have: familiarity with NY DFS Part 500, the NAIC Insurance Data Security Model Law, or the NAIC Model Bulletin on AI use by insurers
Nice-to-have: exposure to ISO/IEC 42001, the NIST AI Risk Management Framework, or other AI governance frameworks
Nice-to-have: experience maintaining a risk register or customer-facing trust center, such as Vanta, Drata, SafeBase, Loopio, or Conveyor
Nice-to-have: experience using AI tools to draft, check, and maintain questionnaire responses
Nice-to-have: familiarity with privacy requirements and data processing agreements, such as CCPA/CPRA and PIPEDA
Nice-to-have: relevant certifications such as CISA, CISSP, CISM, or CRISC

Benefits

Comp & perks

Equity grants for all employees
A 4% matching 401(k) program
Medical, dental, vision, disability, and life insurance coverage for employees working 30+ hours per week
Monthly wellness stipend
Paid parental leave
A flexible vacation policy
Flexible, hybrid work environment
Ample opportunities to learn, take on new challenges, and make an impact
Fun, lively startup culture that embraces creativity and innovation
Culture of engagement, diversity, inclusion, and belonging